CVE-2020-24203
9.8
CRITICAL · CVSS 3.1 · EPSS 3.7% (pctl 90)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.74% — more likely to be exploited than 90% of all CVEs |
| Weakness | CWE-425 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-08-27 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| projectworlds | travel management system |
References
- https://github.com/hyd3sec/TravelManagementSystemRCE
- https://projectworlds.in/free-projects/php-projects/travel-management-system-project-in-php-mysql/
- https://github.com/hyd3sec/TravelManagementSystemRCE
- https://projectworlds.in/free-projects/php-projects/travel-management-system-project-in-php-mysql/
→ the Explorer · watch your stack · NVD