CVE-2020-18877

SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/index.php'.

• CWE-89

• https://github.com/wuzhicms/wuzhicms/issues/175Exploit, Issue Tracking, Third Party Advisory
• https://github.com/wuzhicms/wuzhicms/issues/175Exploit, Issue Tracking, Third Party Advisory

Published

Aug 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-18831Buffer Overflow vulnerability in tEXtToDataBuf function in p…7.8
• CVE-2020-18839Buffer Overflow vulnerability in HtmlOutputDev::page in popp…6.5
• CVE-2020-1885Writing to an unprivileged file from a privileged OVRRedir.e…7.8
• CVE-2020-1886A buffer overflow in WhatsApp for Android prior to v2.20.11 …8.8
• CVE-2020-1887Incorrect validation of the TLS SNI hostname in osquery vers…9.1
• CVE-2020-18875Incorrect Access Control in DotCMS versions before 5.1 allow…8.8
• CVE-2020-18878Directory Traversal in Skycaiji v1.3 allows remote attackers…5.3
• CVE-2020-18879Unrestricted File Upload in Bludit v3.8.1 allows remote atta…9.8
• CVE-2020-1888Insufficient boundary checks when decoding JSON in handleBac…7.5
• CVE-2020-18885Command Injection in PHPMyWind v5.6 allows remote attackers …7.2
• CVE-2020-18886Unrestricted File Upload in PHPMyWind v5.6 allows remote att…7.2
• CVE-2020-18888Arbitrary File Deletion vulnerability in puppyCMS v5.1 allow…7.5