CVE-2020-20294

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/arterli/CmsWing/issues/49Exploit, Third Party Advisory
https://github.com/arterli/CmsWing/issues/49Exploit, Third Party Advisory

Timeline

Published: Feb 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-202959.8An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parame CVE-2020-202969.8An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious par CVE-2020-202989.8Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attack CVE-2020-202997.5WeiPHP 5.0 does not properly restrict access to pages, related to using POST.CVE-2020-20307.2An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS co CVE-2020-203009.8SQL injection vulnerability in the wp_where function in WeiPHP 5.0.CVE-2020-20314.9An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issu CVE-2020-20327.0A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with CVE-2020-20335.3When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon CVE-2020-203357.5Buffer Overflow vulnerability in Antirez Kilo before commit 7709a04ae8520c5b04d261616098cebf742f5a23 allows a remote attacker to cause a den CVE-2020-20348.1An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitra CVE-2020-203407.5A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database infor