CVE-2018-25184mediumCWE-22

CVE-2018-25184: medium-severity vulnerability in Getsurreal Surreal ToDo

Surreal ToDo 0.6.1.2 Local File Inclusion via index.php

Published · Updated

Follow this CVE+ Monitor Surreal ToDo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.9%
Surreal ToDo 0.6.1.2 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the content parameter. Attackers can supply directory traversal sequences through the content parameter in index.php to access sensitive system files like configuration and initialization files.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Getsurreal · Surreal ToDo