CVE-2020-28136

8.8 highEPSS 3.1%

High (8.8) in phpgurukul tourism management system. EPSS 3.1% chance of exploitation in the next 30 days.

An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.1% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2020-11-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phpgurukul:tourism_management_system

References

https://phpgurukul.com/tourism-management-system-free-download/
https://www.exploit-db.com/exploits/48892
https://phpgurukul.com/tourism-management-system-free-download/
https://www.exploit-db.com/exploits/48892

Check your stack JSON