CVE-2018-16278: Phpkaiyuancms Phpopensourcecms

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajax_save_draft function with the dir parameter.

Affected products

• Phpkaiyuancms Phpopensourcecms: version 3.2.0 only

Published 2018-08-31. Last modified 2026-06-17.