CVE-2020-25537
File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this...
File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission.
- Record
CVE-2020-25537- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission.
- Record
CVE-2020-25537- Updated
- 2026-11-02
EUVDEUVD-2020-18222 No score
File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission.
- Record
EUVD-2020-18222- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vf9r-c7v2-7275 No score
File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this...
File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission.
- Record
GHSA-vf9r-c7v2-7275- Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-25537 is a critical vulnerability (CVSS 9.8) in Ucms Project Ucms, published November 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. No source names a fixed version.