Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.9

Frog CMS allows attackers to upload malicious files

CVE-2018-16373 · published 8 years ago
Summary

The Frog CMS 0.9.5 content management system lets anyone with access to the admin area place files on the server through a specific upload function. This could let an attacker add harmful files that could be executed later. Upgrade to a newer version or apply the vendor's fix and limit admin access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
frog_cms_project frog_cms 0.9.5
cpe:2.3:a:frog_cms_project:frog_cms:0.9.5:*:*:*:*:*:*:*
Original advisory text
Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.
Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.9 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published3 Sep 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-16373 · NVD
Track software like this
Free during beta