CVE-2018-11392

An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login &...

8.8 High

An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed in the Envato Market, allows any remote authenticated user to upload .php files to the web server via a profile avatar field. This results in arbitrary code execution by requesting the .php file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.39%Up 1.0 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2018-11392
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-434
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-11392
Updated: 2026-11-02

EUVDEUVD-2018-3426 No score

Record: EUVD-2018-3426
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qmxw-fm9h-f8xr 8.8

An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login &...

Record: GHSA-qmxw-fm9h-f8xr
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

Affected products

jigowatt php login \& user management

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-11392 is a high vulnerability (CVSS 8.8) in Jigowatt Php Login \& User Management, published May 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.39%, the 88th percentile. No source names a fixed version.