PT-2026-23674 · Undefined · Undefined

Published 2026-03-06 · Updated 2026-03-06 · CVE-2018-25162

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2-Plan Team 1.0.4 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload executable PHP files by sending multipart form data to managefile.php. Attackers can upload PHP files through the userfile1 parameter with action=upload, which are stored in the files directory and executed by the web server for remote code execution.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-25162

Affected Products

Undefined

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-25162 · Security Note
• https://exploit-db.com/exploits/45878 · Note
• https://vulncheck.com/advisories/plan-team-arbitrary-file-upload-via-managefilephp · Note