First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2020-12785

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://documentation.cpanel.net/display/CL/86+Change+LogVendor Advisory
https://news.cpanel.com/cpanel-tsr-2020-0002-full-disclosure/Vendor Advisory
https://documentation.cpanel.net/display/CL/86+Change+LogVendor Advisory

Timeline

Published: May 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-127877.5Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.CVE-2020-127887.5CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.CVE-2020-127897.5The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.CVE-2020-12797.8An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly load spotlight images from a secure location, aka 'CVE-2020-127907.5In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Te CVE-2020-127975.3HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers.CVE-2020-127987.8Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command prompt via the Wind CVE-2020-12807.8An elevation of privilege vulnerability exists in the way that the Windows Bluetooth Service handles objects in memory, aka 'Windows Bluetoo CVE-2020-128009.8The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code ex CVE-2020-128015.3If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore CVE-2020-128025.3LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode CVE-2020-128036.5ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for