CVE-2018-12990: Phpwcms

Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days.

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.

Affected products

• Phpwcms Phpwcms: version 1.8.9 only

Published 2018-06-30. Last modified 2026-06-17.