CVSS 3.1
4.9 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NCVE-2020-10387
Medium (4.9) in chadhaajay phpkb. EPSS 7.8% chance of exploitation in the next 30 days.
Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence (../) via the GET parameter file.
Severity
- EPSS
- 7.8% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- chadhaajay:phpkb
References
- http://antoniocannito.it/?p=137#afd
- http://packetstormsecurity.com/files/156754/PHPKB-Multi-Language-9-Authenticated-Directory-Traversal.html
- https://antoniocannito.it/phpkb1#authenticated-arbitrary-file-download-cve-2020-10387
- https://www.exploit-db.com/exploits/48220
- http://antoniocannito.it/?p=137#afd