CVE-2020-24195
9.1
CRITICAL · CVSS 3.1 · EPSS 2.9% (pctl 87)
In your normal cycle
Critical by CVSS (9.1), but no sign of active exploitation.
Description
An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution.
Scoring
| CVSS | 9.1 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 2.93% — more likely to be exploited than 87% of all CVEs |
| Weakness | CWE-434 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-09-09 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| online bike rental project | online bike rental |
References
- https://packetstormsecurity.com/files/158704/Online-Bike-Rental-1.0-Shell-Upload.html
- https://www.sourcecodester.com/php/14374/online-bike-rental-phpmysql.html
- https://packetstormsecurity.com/files/158704/Online-Bike-Rental-1.0-Shell-Upload.html
- https://www.sourcecodester.com/php/14374/online-bike-rental-phpmysql.html
→ the Explorer · watch your stack · NVD