CVE-2020-28693

HIGH

Horizontcms - Unrestricted File Upload

Title source: rule
STIX 2.1

Description

An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme, and executing the PHP file via an HTTP GET request to /themes/<php_file_name>

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/ttimot24/HorizontCMS/issues/21

Scores

CVSS v3 8.8
EPSS 0.0226
EPSS Percentile 84.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
horizontcms_project/horizontcms 1.0.0 beta
Published Nov 16, 2020
Tracked Since Feb 18, 2026