CVE-2018-11392: Jigowatt PHP Login & User Management

High severity, CVSS 8.8. EPSS: 3.5% chance of exploitation in the next 30 days.

An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed in the Envato Market, allows any remote authenticated user to upload .php files to the web server via a profile avatar field. This results in arbitrary code execution by requesting the .php file.

Affected products

• Jigowatt PHP Login & User Management: before 4.1.1 (fixed in 4.1.1)

Published 2018-05-29. Last modified 2026-06-17.