CVE-2020-15591

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-155927.5SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an executable running as a CVE-2020-155937.8SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running as a high privileged Windows service to perfCVE-2020-155944.3An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attaCVE-2020-155954.3An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements iCVE-2020-155966.7The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path DiCVE-2020-155975.4SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.CVE-2020-155987.5Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaledCVE-2020-155996.1Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.CVE-2020-15607.8A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who sucCVE-2020-156006.5An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.CVE-2020-156018.1If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x could allow an unautheCVE-2020-156027.8An untrusted search path remote code execution (RCE) vulnerability in the Trend Micro Secuity 2020 (v16.0.0.1146 and below) consumer family
CVE-2020-15591: Critical severity, CVSS 9.8 | Vulnix