CVE-2018-16370: Pescms Team

Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days.

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive.

Affected products

• Pescms Pescms Team: version 2.2.1 only

Published 2018-09-03. Last modified 2026-06-17.