CVE-2019-14240
HIGHWCMS 0.3.2 - Cross-Site Request Forgery and Path Traversal via /wex/html.php
Title source: llmDescription
WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI.
References (1)
Core 1
Core References
Broken Link x_refsource_misc
http://www.iwantacve.cn/index.php/archives/266/
Scores
CVSS v3
8.1
EPSS
0.0084
EPSS Percentile
53.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Details
CWE
CWE-22
CWE-352
Status
published
Products (1)
wcms/wcms
0.3.2
Published
Jul 23, 2019
Tracked Since
Feb 18, 2026