TI-2018-12999 CVE-2018-18382 · GHSA-rw83-94pj-5qh2Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the…Priority MEDIUM 43Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02695 · Published 2018-10-16 · No fix listed CWE-434