$ cve CVE-2020-12471 JSON

CVE-2020-12471

9.8

CRITICAL · CVSS 3.1 · EPSS 2.8% (pctl 86)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

MonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages/SocialNetworking/lng/en-US/PhotoGallery.aspx because of deserialization in ModuleGallery.HTML5Upload, ModuleGallery.SilverLightUploadModule, HTML5Upload, and SilverLightUploadHandler.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	2.76% — more likely to be exploited than 86% of all CVEs
Weakness	CWE-502
On CISA KEV	no
Public exploit	none known
Published	2020-04-29
Last modified	2026-06-17

Affected (1)

Vendor	Product
mono	monox

References

https://github.com/belong2yourself/vulnerabilities/tree/master/MonoX%20CMS/Remote%20Code%20Execution%20via%20Insecure%20Deserialization
https://github.com/belong2yourself/vulnerabilities/tree/master/MonoX%20CMS/Remote%20Code%20Execution%20via%20Insecure%20Deserialization

→ the Explorer · watch your stack · NVD