CVE-2020-10225

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unauthenticated file upload vulnerability has been identified in admin/gallery.php in PHPGurukul Job Portal 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://tib3rius.com/cves.htmlThird Party Advisory
https://www.exploit-db.com/exploits/47881Third Party Advisory, VDB Entry
https://tib3rius.com/cves.htmlThird Party Advisory
https://www.exploit-db.com/exploits/47881Third Party Advisory, VDB Entry

Timeline

Published: Mar 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-102276.1A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript co CVE-2020-102288.8A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote co CVE-2020-102298.8A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, a CVE-2020-10238.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa CVE-2020-102309.8CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php t CVE-2020-102317.5TP-Link NC200 through 2.1.8_Build_171109, NC210 through 1.0.9_Build_171214, NC220 through 1.3.0_Build_180105, NC230 through 1.3.0_Build_1712 CVE-2020-102329.8In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing log CVE-2020-102339.1In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.CVE-2020-102346.5The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL to the device driver.CVE-2020-102358.8An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary co CVE-2020-102366.1An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation direct CVE-2020-102375.5An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, set