CVE-2020-11011

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Phproject before version 1.7.8, there's a vulnerability which allows users with access to file uploads to execute arbitrary code. This is patched in version 1.7.8.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Alanaktion	Phproject	< 1.7.8

References

https://github.com/Alanaktion/phproject/commit/b49d642e035d835f824bd39babd964ec0e3a285fPatch, Third Party Advisory
https://github.com/Alanaktion/phproject/security/advisories/GHSA-4j97-6w6q-gxjxMitigation, Third Party Advisory
https://github.com/Alanaktion/phproject/commit/b49d642e035d835f824bd39babd964ec0e3a285fPatch, Third Party Advisory
https://github.com/Alanaktion/phproject/security/advisories/GHSA-4j97-6w6q-gxjxMitigation, Third Party Advisory

Timeline

Published: Apr 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-110127.5MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it CVE-2020-110135.0Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function i CVE-2020-110148.6Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edi CVE-2020-110159.1A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed.CVE-2020-110168.8IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user CVE-2020-110176.5In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the s CVE-2020-110186.5In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out o CVE-2020-110196.5In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a r CVE-2020-11028.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa CVE-2020-110209.8Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extens CVE-2020-110217.5Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redire CVE-2020-110226.1In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM man