peter bassill · operator
$ cve CVE-2018-13981 JSON

CVE-2018-13981 EXPLOIT

9.8
CRITICAL · CVSS 3.0 · EPSS 17.1% (pctl 97)

Patch early

A public exploit exists.

Description

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files, because the formmailer widget blocks .php files but not .php5 or .phtml files. This is related to /assets/php/formmailer/SendEmail.php and /assets/php/formmailer/functions.php.

Scoring

CVSS9.8 (CRITICAL, v3.0)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS17.07% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-434
On CISA KEVno
Public exploityes
Published2018-07-16
Last modified2026-06-17

Affected (1)

VendorProduct
zeta-producerzeta producer desktop cms

Public exploits

References

→ the Explorer  ·  watch your stack  ·  NVD