CVE-2020-36973

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

PDW File Browser 1.3 contains a remote code execution vulnerability that allows authenticated users to upload and rename webshell files to arbitrary web server locations. Attackers can upload a .txt webshell, rename it to .php, and move it to accessible directories using double-encoded path traversal techniques.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-369747.8Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary CVE-2020-369757.8EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrCVE-2020-369767.8Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local userCVE-2020-369777.8Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attaCVE-2020-369786.4Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. AttaCVE-2020-369797.8Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers cCVE-2020-36989.8Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon ACVE-2020-369807.8SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers toCVE-2020-369817.8Motorola Device Manager 2.4.5 contains an unquoted service path vulnerability in the PST Service that allows local users to potentially execCVE-2020-369827.8Motorola Device Manager 2.5.4 contains an unquoted service path vulnerability in the MotoHelperService.exe service that allows local users tCVE-2020-369837.8Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code during sCVE-2020-369847.8EPSON 1.124 contains an unquoted service path vulnerability in the SENADB service that allows local attackers to execute code with elevated
CVE-2020-36973: Medium severity, CVSS 6.5 | Vulnix