CVE-2019-16192: Doccms

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.

Affected products

• Doccms Doccms: version 2016.5.17 only

Published 2019-09-09. Last modified 2026-06-17.