CVE-2020-23653

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-236545.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."CVE-2020-236555.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."CVE-2020-236565.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."CVE-2020-236575.4NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."CVE-2020-236585.4PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.CVE-2020-236595.4WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.CVE-2020-236605.4webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."CVE-2020-236799.8Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field CVE-2020-236807.8An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possib CVE-2020-236859.8SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the usernam CVE-2020-236868.8Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified i CVE-2020-236894.8In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.