CVE-2020-21516

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-215176.1Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.CVE-2020-21526.1Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, reCVE-2020-215229.8An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend,the attacker can overwrite some files, sCVE-2020-215239.8A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. ThCVE-2020-215249.1There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migratCVE-2020-215257.5Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performeCVE-2020-215269.8An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is perCVE-2020-215277.7There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their bacCVE-2020-215285.5A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a dCVE-2020-215295.5fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c.CVE-2020-21534.3Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resultCVE-2020-215305.5fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c.
CVE-2020-21516: Critical severity, CVSS 9.8 | Vulnix