Vulnerability in N/a
CVE-2020-27386
An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file ty…
EPSS: 0.779 (99.0th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.9 (x_refsource_MISC)
- blog.vonahi.io/whats-in-a-re-name/ (x_refsource_MISC)
- github.com/rapid7/metasploit-framework/pull/14339 (x_refsource_MISC)
- packetstormsecurity.com/files/160411/FlexDotnetCMS-1.5.8-Arbitrary-ASP-File-Upl… (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-27386?
- CVE-2020-27386 is a vulnerability in N/a. Published 2020-11-12.
- Is CVE-2020-27386 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.