Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-22 | 1 | Patch1 |
| 2026-04-23 | 1 | Disclosure1 |
Warning: Critical authorisation bypass vulnerability in #ThinkPHP. CVE-2018-25270 CVSS: 9.8. Successful exploitation allows an unauthenticated attacker to perform remote code execution. #RCE! #Patch #Patch #Patch
Post summary
The tweet announces a critical authorization-bypass flaw (CVE-2018-25270) in ThinkPHP that allows remote code execution with high severity, but it does not provide exploit details or patches.
🚨 CVE-2018-25270: ThinkPHP 5.0.23 Remote Code Exec... Unauthenticated RCE through function invocation makes every ThinkPHP 5.x instance a one-click shell - patch immediately... https://zerodaysignal.com/vulnerability/CVE-2018-25270 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A newly disclosed unauthenticated RCE in ThinkPHP 5.0.23 is highlighted with an urgent patch notice and a link to further details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | thinkphp | thinkphp | - | - | - |
| App | thinkphp | thinkphp | 5.1.31 | - | - |