{"id":"CVE-2018-12990","details":"phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field.","modified":"2026-07-08T14:14:22.787543Z","published":"2018-06-30T14:29:00.240Z","references":[{"type":"EVIDENCE","url":"https://3xpl01tc0d3r.blogspot.com/2018/06/information-disclosure-internal-path.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/slackero/phpwcms","events":[{"introduced":"193f6d38cd1d461a1fdbad1b76ee4ae9272a57ff"},{"last_affected":"193f6d38cd1d461a1fdbad1b76ee4ae9272a57ff"}],"database_specific":{"cpe":"cpe:2.3:a:phpwcms:phpwcms:1.8.9:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8.9"},{"last_affected":"1.8.9"}],"source":"CPE_STRING"}}],"versions":["1.8.9","phpwcms-1.8.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12990.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}