CVE-2020-27956

9.8 criticalEPSS 5.4%

Critical (9.8) in car rental management system project car rental management system. EPSS 5.4% chance of exploitation in the next 30 days.

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=manage_car because .php files can be uploaded to admin/assets/uploads/ (under the web root).

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.4% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2020-10-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

car_rental_management_system_project:car_rental_management_system

References

https://www.exploit-db.com/exploits/48931
https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html
https://www.exploit-db.com/exploits/48931
https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html

Check your stack JSON