CVE-2020-28939

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

OpenClinic version 0.8.2 is affected by a medical/test_new.php insecure file upload vulnerability. This vulnerability allows authenticated users (with substantial privileges) to upload malicious files, such as PHP web shells, which can lead to arbitrary code execution on the application server.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Dec 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-28946.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-289409.8On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allo CVE-2020-289415.5An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the CVE-2020-289424.3An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJB CVE-2020-289436.5OX App Suite 7.10.4 and earlier allows SSRF via a snippet.CVE-2020-289447.5OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data.CVE-2020-289456.1OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as ![](http://onerror=Function.constru CVE-2020-289467.5An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker (with network access to the device) CVE-2020-289476.1In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.CVE-2020-289487.8Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.CVE-2020-289497.8Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as fil CVE-2020-28954.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Ea