CVE-2020-23972

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload files which due to issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-239739.8KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.CVE-2020-239745.4Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag),CVE-2020-239756.1Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter.CVE-2020-239769.8Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has SQL Injection via the 'content.php' id parameter.CVE-2020-239776.1KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter.CVE-2020-239789.8SQL injection can occur in Soluzione Globale Ecommerce CMS v1 via the parameter " offerta.php"CVE-2020-239799.813enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter.CVE-2020-239809.8DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page.CVE-2020-239816.113enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter.CVE-2020-239826.1DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'CVE-2020-239835.4Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.CVE-2020-239845.4Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags.