CVE-2020-18127

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Aug 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-181298.8A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.CVE-2020-18136.8HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. Due to improper auCVE-2020-181318.8Cross Site Request Forgery (CSRF) vulnerability in Bluethrust Clan Scripts v4 allows attackers to escilate privledges to an arbitrary accounCVE-2020-181324.8Cross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryECVE-2020-18145.3Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001CCVE-2020-181449.8SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.CVE-2020-181456.1Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php.CVE-2020-18157.5Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001CCVE-2020-181516.5Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.CVE-2020-181559.8SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.CVE-2020-181578.8Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.CVE-2020-181585.4Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.