CVE-2020-17564

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.51cto.com/12653365/2328557Exploit, Third Party Advisory
http://blog.51cto.com/12653365/2328557Exploit, Third Party Advisory

Timeline

Published: Apr 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-17578.1A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to un CVE-2020-17585.9A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using t CVE-2020-17596.8A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was disco CVE-2020-17606.1A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to poten CVE-2020-17616.1A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this fla CVE-2020-17628.6An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a re CVE-2020-17637.5An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker CVE-2020-17648.6A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote at CVE-2020-17655.3An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, A CVE-2020-17666.1Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malic CVE-2020-17674.3Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the na CVE-2020-17685.4The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the Sessi