CVE-2020-36970

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can exploit the unsanitized file path input to access sensitive files like /etc/passwd by sending crafted requests to the getgif.php endpoint.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-369718.4Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter. Attackers caCVE-2020-369727.5SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to eCVE-2020-369736.5PDW File Browser 1.3 contains a remote code execution vulnerability that allows authenticated users to upload and rename webshell files to aCVE-2020-369747.8Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary CVE-2020-369757.8EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrCVE-2020-369767.8Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local userCVE-2020-369777.8Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attaCVE-2020-369786.4Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. AttaCVE-2020-369797.8Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers cCVE-2020-36989.8Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon ACVE-2020-369807.8SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers toCVE-2020-369817.8Motorola Device Manager 2.4.5 contains an unquoted service path vulnerability in the PST Service that allows local users to potentially exec