CVE-2018-20478: S-CMS

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value.

Affected products

• S-CMS S-CMS: version 1.0 only

Published 2018-12-26. Last modified 2026-06-17.