← Vulnerability Intelligence

CVE-2018-20062

Critical 9.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
ThinkPHP "noneCms" Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
100% (percentile: 100) as of 1 November 2026

Affected products

5none: nonecms

References