CVE-2020-27461

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote code execution through an authenticated file upload via the Settings Panel>Import website function.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://sourceforge.net/projects/seopanel/files/seopanel.v.4.6.0.zip/downloadPatch, Third Party Advisory
https://www.exploit-db.com/exploits/48862Exploit, Third Party Advisory, VDB Entry
https://www.seopanel.org/Product
https://sourceforge.net/projects/seopanel/files/seopanel.v.4.6.0.zip/downloadPatch, Third Party Advisory
https://www.exploit-db.com/exploits/48862Exploit, Third Party Advisory, VDB Entry
https://www.seopanel.org/Product

Timeline

Published: Aug 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-274647.8An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted CVE-2020-274667.8An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code v CVE-2020-274677.5A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.CVE-2020-27475.4Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: SSO Engine). Supported versions that are affected CVE-2020-274787.1Cross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru 3103357200c70b4767986544e01b19dbf1 CVE-2020-27483.2Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-274819.8An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPr CVE-2020-274839.9Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the v CVE-2020-274849.9Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vu CVE-2020-274859.9Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the v CVE-2020-274869.9Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vul CVE-2020-274889.8Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signatur