CVE-2020-13448 EXPLOIT
8.8
HIGH · CVSS 3.1 · EPSS 17.4% (pctl 97)
Patch early
A public exploit exists.
Description
QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter.
Scoring
| CVSS | 8.8 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 17.4% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2020-06-01 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| quickbox | quickbox |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | QuickBox Pro 2.1.8 - Authenticated Remote Code Execution | 2020-06-01 |
References
→ the Explorer · watch your stack · NVD