Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Frog CMS 0.9.5 file manager enables code execution

CVE-2018-20778 · published 7 years ago
Summary

The file manager in Frog CMS version 0.9.5 can be tricked into creating a file that contains a specially crafted image tag. When a user views that file, the malicious code runs in their browser, potentially exposing session data or other information. Apply the latest security update from the vendor or disable the file manager feature until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
frog_cms_project frog_cms 0.9.5
cpe:2.3:a:frog_cms_project:frog_cms:0.9.5:*:*:*:*:*:*:*
Original advisory text
admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.
admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Feb 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-20778 · NVD
Track software like this
Free during beta