ACTIVELY EXPLOITED
CVE-2018-20062: ThinkPHP "noneCms" Remote Code Execution Vulnerability
| Vendor | ThinkPHP |
|---|---|
| Product | noneCms |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-20 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
SOURCES
Other ThinkPHP flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.