CVE-2018-25388CWE-434

HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php

High · published May 29, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php to execute arbitrary code on the server.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-05-29T14:46Z
EPSS history
Timeline
  • 29 MAY 14:46Z
    HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php
    cvelistv5