CVE-2020-7998

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path that is accessible and hidden next to the root path. By default, there is no password set for the FTP or Web UI service.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://apps.apple.com/us/app/super-file-explorer-file-viewer-file-manager/id1101973946Product, Third Party Advisory
https://gist.github.com/adeshkolte/9e60b2483d2f20d1951beac0fc917c6fThird Party Advisory
https://apps.apple.com/us/app/super-file-explorer-file-viewer-file-manager/id1101973946Product, Third Party Advisory
https://gist.github.com/adeshkolte/9e60b2483d2f20d1951beac0fc917c6fThird Party Advisory

Timeline

Published: Jan 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79999.8The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY.CVE-2020-80009.8Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account.CVE-2020-80019.8The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account.CVE-2020-80025.5A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands tha CVE-2020-80035.5A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering t CVE-2020-80047.5STMicroelectronics STM32F1 devices have Incorrect Access Control.CVE-2020-80068.8The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time CVE-2020-80079.8The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via th CVE-2020-80097.5AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file.CVE-2020-80109.8CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the r CVE-2020-80117.5CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the CVE-2020-80129.8CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (c