CVE-2018-18382: Coderpixel Advanced Hrm

High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.

Affected products

• Coderpixel Advanced Hrm: version 1.6 only

Published 2018-10-16. Last modified 2026-06-17.