Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2018-25388: HaPe PKH 1.1 allows attackers to upload malicious PHP files
CVE-2018-25388 · published 5 months ago
Summary
The HaPe PKH software has a security weakness that allows authorized users to upload PHP files on the server. This could allow attackers to execute malicious code on the server, potentially leading to data breaches or system compromise. To protect against this, update to the latest version of HaPe PKH or restrict file uploads to trusted users.
Original advisory text
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through ...
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php to execute arbitrary code on the server.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-434Unrestricted File Upload
Timeline
Published29 May 2026
Updated4 Nov 2026
First seen29 May 2026
Sources
CVE-2018-25388 · NVD
Track software like this
Free during beta