CVE-2020-20287

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Feb 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-202899.8Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters, triggers a sql injeCVE-2020-20297.2An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS comCVE-2020-202907.5Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the requesCVE-2020-202949.8An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can exeCVE-2020-202959.8An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameCVE-2020-202969.8An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parCVE-2020-202989.8Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackCVE-2020-202997.5WeiPHP 5.0 does not properly restrict access to pages, related to using POST.CVE-2020-20307.2An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS coCVE-2020-203009.8SQL injection vulnerability in the wp_where function in WeiPHP 5.0.CVE-2020-20314.9An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issuCVE-2020-20327.0A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with
CVE-2020-20287: Critical severity, CVSS 9.8 | Vulnix