CVE-2020-24742

HighCVSS 7.8/10Last modified Oct 8, 2026

Description

An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Aug 9, 2021
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-247439.8An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via CVE-2020-247508.1FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.h CVE-2020-247539.8A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execut CVE-2020-247557.8In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impe CVE-2020-247657.5InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monit CVE-2020-247699.8SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes par CVE-2020-247709.8SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2020-247717.5Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.CVE-2020-247728.8In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Cla CVE-2020-247869.8An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService CVE-2020-247919.8FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to CVE-2020-247946.1Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75.