portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12263.json"