CVE-2020-23766

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server should they gain Administrator privileges.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 21, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-237687.5An information disclosure vulnerability was discovered in alipay_function.php in the log file of Alibaba payment interface on PHPPYUN prior CVE-2020-237746.1A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed.CVE-2020-237767.5A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to causeCVE-2020-237909.8An Arbitrary File Upload vulnerability was discovered in the Golo Laravel theme v 1.1.5.CVE-2020-237938.6An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product. There is a security vulnerablility thaCVE-2020-238047.5Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.CVE-2020-238117.5xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.CVE-2020-238146.1Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) CVE-2020-238248.8ArGo Soft Mail Server 1.8.8.9 is affected by Cross Site Request Forgery (CSRF) for perform remote arbitrary code execution. The component isCVE-2020-238268.8The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API. NOTECVE-2020-238289.8A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution (RCE)CVE-2020-238298.8interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote a