CVE-2020-10386

⚠️ high

Summary

admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory.

CVSS Score

7.2

High

EPSS Score

18.7

Exploit Probability

Published Date

2020-03-12

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 55.5% of all 325,576 vulnerabilities in our database.

#144,832

Above average severity

Severity Percentile

Last Modified 2024-11-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-434

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
chadhaajay	phpkb	Affected	v9.0

🔗 References 4

http://antoniocannito.it/?p=137#rce1

Exploit Third Party Advisory

http://packetstormsecurity.com/files/156757/PHPKB-Mu...

Exploit Third Party Advisory VDB Entry

https://antoniocannito.it/phpkb1#remote-code-executi...

Exploit Third Party Advisory

https://www.exploit-db.com/exploits/48221

Exploit Third Party Advisory VDB Entry

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2020-11579	⚠️ high	7.5	36.7	An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation ...	2020-09-03
CVE-2020-10387	🔶 medium	4.9	12.8	Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files...	2020-03-12
CVE-2020-10388	🔶 medium	5.4	0.3	The way the Referer header in article.php is handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execu...	2020-03-12
CVE-2020-10389	⚠️ high	7.2	9.0	admin/save-settings.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by i...	2020-03-12
CVE-2020-10390	⚠️ high	7.2	4.7	OS Command Injection in export.php (vulnerable function called from include/functions-article.php) in Chadha PHPKB Stand...	2020-03-12
CVE-2020-10391	🔶 medium	4.8	0.3	The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting a...	2020-03-12

These CVEs affect the same products