CVE-2018-16373

MEDIUM

Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.

Affects 1 product across 1 vendor.

CVSS 3.04.9
EPSS1.1%
Percentile64th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, high privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-434: Unrestricted Upload of File with Dangerous Type

Application allows file uploads without validating type, enabling upload of executable code or web shells.

Related Attack Patterns (CAPEC)
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
via CWE-434

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A medium severity vulnerability affects Frog Cms Project systems (CVE-2018-16373). A proof-of-concept has been published. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-208686-M • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-16373?
This vulnerability was disclosed in 2018. A medium severity vulnerability affects Frog Cms Project systems (CVE-2018-16373). A proof-of-concept has been published. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-16373?
CVE-2018-16373 has CVSS 4.9 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. EPSS: 1.1%.
Is CVE-2018-16373 actively exploited?
No confirmed active exploitation of CVE-2018-16373 as of 2026-05-30.
How do I remediate CVE-2018-16373?
Priority: MONITOR.
What systems are affected by CVE-2018-16373?
CVE-2018-16373 affects Frog Cms Project Frog Cms.
Vulnerability Details
CVE IDCVE-2018-16373
BSIDBS-2018-GLOBAL-208686-M BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Published2018-09-03
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Unrestricted Upload of File with Dangerous Type
SourceNVD
Official Description

Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Frog Cms Project Frog Cms 0.9.5
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2965 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash7c90c3ff7fafe0a926a53e7c4805be7a66837a8d7e5170426436251fe93cde44b1a46f540db2c4214b14e12253b128e8311bc0a4659269196d8ee6fa3cae19ef
Related CVEs affecting Frog Cms Project
CVE-2021-26794 9.8 Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacke... CVE-2014-4912 9.8 An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack o... CVE-2018-8908 8.8 An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The applicati... CVE-2018-16447 8.8 Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF. CVE-2024-42630 8.8 FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) ...
View all Frog Cms Project CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →