CVE-2018-18890

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10

Description The issue allows for full path disclosure through the "/mc-admin/post.php" endpoint with specific parameters, such as state set to "delete" and delete set to an invalid filename.

Recommendations For MiniCMS version 1.10, as a temporary workaround, consider restricting access to the "/mc-admin/post.php" endpoint until a patch is available. Additionally, validate and sanitize the delete parameter to prevent disclosure of sensitive information.