CVE-2018-13865: Idreamsoft Icms

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism.

Affected products

• Idreamsoft Icms: version 7.0.9 only

Published 2018-07-10. Last modified 2026-06-17.