PatchTheCVECVE-2018-19514: In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authen
CVE-2018-19514 is a critical-severity flaw (CVSS 9.8) affecting webgalamb. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authentication bypass to access administrative functions of the site to upload a crafted CSV file with a malicious payload that becomes part of a PHP eval() expression in the subscriber.php file.
Why this priority
- Critical severity
- EPSS top 8%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 4.9% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-434 |
| Published | 2019-03-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-19514?
webgalamb: upgrade to newer than 7.0. Exact commands for each OS are on this page.
Is CVE-2018-19514 being exploited?
CVE-2018-19514 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-19514 affect?
CVE-2018-19514 affects webgalamb. Severity is critical (CVSS 9.8). In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authentication bypass to access administrative functions of the site to upload a crafted CSV file
How urgent is CVE-2018-19514?
Priority 67/100. Critical severity; EPSS top 8%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2018-19515 CRITICAL 9.8 UPGRADE In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator
- CVE-2018-19513 HIGH 7.5 UPGRADE In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY
- CVE-2018-19512 HIGH 7.2 UPGRADE In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to
- CVE-2018-19511 MEDIUM 6.5 DOWNGRADE wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1
- CVE-2018-19510 CRITICAL 9.8 UPGRADE subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.