CVE-2020-36942

HIGH

Victor CMS 1.0 - RCE

Title source: llm

Description

Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Attackers can upload a PHP shell to the /img directory and execute system commands by accessing the uploaded file via web browser.

Exploits (1)

exploitdb WORKING POC

by Mosaaed · textwebappsphp

https://www.exploit-db.com/exploits/49310

View Code ZIP pw:eip

References (3)

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/49310

[Product] https://github.com/VictorAlagwu/CMSsite

[Third Party Advisory] https://www.vulncheck.com/advisories/victor-cms-file-upload-to-rce

Scores

CVSS v3 8.8

EPSS 0.0012

EPSS Percentile 30.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

victor_cms_project/victor_cms 1.0

Published Jan 27, 2026

Tracked Since Feb 18, 2026