← Vulnerability feed

Vulnerability record · CVE-2018-1999022 · published 23 July 2018

CVE-2018-1999022: Html quickform project html quickform code injection vulnerability

HHtml Quickform Project · Html Quickform

PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.

9.8 CVSS 3.0 Critical EPSS 2.2% · top 18.1% CWE-94 · Code injection
9.8CVSS 3.0 base score, v2 7.5
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform/ Vendor Advisory
https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform Third Party Advisory
http://blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform/ Vendor Advisory
https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform Third Party Advisory

Track CVE-2018-1999022 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2020-36388Civicrm unrestricted file upload vulnerabilityIn CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.EPSS 1.5%7.5CVE-2013-5957Civicrm sql injection vulnerabilityMultiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 al…EPSS 2.1%6.5CVE-2013-4662Civicrm sql injection vulnerabilityThe Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and cond…EPSS 1.0%6.1CVE-2025-65187Civicrm cross-site scripting vulnerabilityA Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious…EPSS 0.22%5.8CVE-2011-5239Civicrm improper input validation vulnerabilityCiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of t…EPSS 0.53%5.4CVE-2023-25440Civicrm cross-site scripting vulnerabilityStored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/…EPSS 2.5%4.9CVE-2013-4661Civicrm permissions and access controls vulnerabilityCiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom search…EPSS 0.99%4.3CVE-2020-36389Civicrm cross-site request forgery vulnerabilityIn CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.EPSS 0.66%

Source: NIST National Vulnerability Database (record CVE-2018-1999022), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.