Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-28337

EPSS 13.81% · P94
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2020-28337

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Microweber 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microweber是美国Microweber社区的一套可提供拖拽功能的网上商店管理系统。该系统包括添加商品、图片等模块。 Microweber中存在路径遍历漏洞，该漏洞源于网络系统或产品未能正确地过滤资源或文件路径中的特殊元素。攻击者可利用该漏洞访问受限目录之外的位置。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2020-28337

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-28337

请登录查看更多情报信息。

Same Patch Batch · n/a · 2021-02-15 · 28 CVEs total

CVE-2021-233377.2 HIGHCommand Injection
CVE-2021-233386.6 MEDIUMDeserialization of Untrusted Data
CVE-2021-233365.9 MEDIUMWeb Cache Poisoning
CVE-2020-285005.3 MEDIUMRegular Expression Denial of Service (ReDoS)
CVE-2020-22427Nagios XI 代码注入漏洞
CVE-2021-26822Teachers Record Management System SQL注入漏洞
CVE-2020-35734Batflat 注入漏洞
CVE-2021-26201CASAP Automated Enrollment SQL注入漏洞
CVE-2021-26200SourceCodester user area for Library System SQL注入漏洞
CVE-2021-3239Sourcecodester Pisay Online E-Learning System SQL注入漏洞
CVE-2020-29143OpenEMR SQL注入漏洞
CVE-2020-29139OpenEMR SQL注入漏洞
CVE-2020-29140OpenEMR SQL注入漏洞
CVE-2020-29142OpenEMR SQL注入漏洞
CVE-2021-27211Steghide 安全漏洞
CVE-2021-27201Endian Firewall Community 操作系统命令注入漏洞
CVE-2021-3375Atomi ActivePresenter 缓冲区错误漏洞
CVE-2020-24899Nagios XI和Nagios 命令注入漏洞
CVE-2021-25296Nagios XI 安全漏洞
CVE-2020-22425Centreon SQL注入漏洞

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2020-28337

No comments yet

Leave a comment