← Back to browse · API

CVE-2019-9082

Severity
HIGH
CVSS
8.8
EPSS
0.97419
Risk score
59.1
CISA KEV
Yes
PoC
No
Published
2019-02-24
Modified
2025-12-09
First seen
2026-08-07
Aliases
EUVD-2019-18467, GHSA-QPGR-MP84-GP92
Products
ThinkPHP:ThinkPHP, n/a:n/a n/a
Sources
cisa.gov CVE-2019-9082
euvd EUVD-2019-18467

Description

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

References