CVE-2020-4043

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don't use PHP's phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40447.8The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp CVE-2020-40457.5SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly CVE-2020-40465.4In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inj CVE-2020-40476.8In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media CVE-2020-40485.7In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted CVE-2020-40492.4In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript CVE-2020-40503.1In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It CVE-2020-40515.4In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less tha CVE-2020-40526.1In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure v CVE-2020-40536.8In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar arch CVE-2020-40547.3In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML CVE-2020-40597.3In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the librar