CVE-2018-17566: ThinkPHP

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.

Affected products

• ThinkPHP ThinkPHP: version 5.1.24 only

Published 2018-09-26. Last modified 2026-06-17.