CVE-2018-18529

CRITICAL · CVSS 9.8 EPSS 1.20%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-10-19 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE

CVE-2018-18529

Severity

CRITICAL

CVSS

9.8

EPSS

1.20%

Original Filing — NVD Description

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI.