Every CVE Search/ Get API key

CVE-2020-15591

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for...

9.8 CriticalFix available

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.06%Up 0.1 points since Mar 18, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Record
CVE-2020-15591
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
CVE List No score

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Record
CVE-2020-15591
Updated
2026-11-02
EUVDEUVD-2020-7578 No score

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Record
EUVD-2020-7578
Updated
2026-11-03
GitHub AdvisoriesGHSA-qfp9-57pm-rg3f 9.8

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for...

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Record
GHSA-qfp9-57pm-rg3f
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 9.8

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Record
CVE-2020-15591
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-15591 9.8

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Record
DEBIAN-CVE-2020-15591
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-15591 9.8

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Record
UBUNTU-CVE-2020-15591
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fex
Debian:12
 before 20160919-2, plus listed versions
20110601-120110608-120110608-220110610-120110610-2
Show 42 moreShow less
20110620-120110622-120110726-120110726-1~bpo60+120111129-120111129-220120215-120120215-220120215-320120215-3~bpo60+120120718-120120718-220120718-320120718-420120718-520120930-120121027-120121107-120121107-1~bpo60+120130217-120130510-120130805-120140226-120140313-120140530-120140806-120140818-120140902-120140902-1~bpo70+120140902-220140917-120140917-1~bpo70+120140917-220150120-120150120-220150729-120150826-120160104-120160328-120160919-120160919-2~deb10u120160919-2~deb9u1
20160919-2
fex
Debian:13
 before 20160919-2, plus listed versions
20110601-120110608-120110608-220110610-120110610-2
Show 42 moreShow less
20110620-120110622-120110726-120110726-1~bpo60+120111129-120111129-220120215-120120215-220120215-320120215-3~bpo60+120120718-120120718-220120718-320120718-420120718-520120930-120121027-120121107-120121107-1~bpo60+120130217-120130510-120130805-120140226-120140313-120140530-120140806-120140818-120140902-120140902-1~bpo70+120140902-220140917-120140917-1~bpo70+120140917-220150120-120150120-220150729-120150826-120160104-120160328-120160919-120160919-2~deb10u120160919-2~deb9u1
20160919-2
fex
Ubuntu:16.04:LTS
 All versions, plus listed versions
20150729-120150826-120160104-1
 None known
fex
Ubuntu:18.04:LTS
 All versions, plus listed versions
20160919-1
 None known
fex
Ubuntu:20.04:LTS
 All versions, plus listed versions
20160919-1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15591 is a critical vulnerability (CVSS 9.8) in Uni-stuttgart Frams\' Fast File Exchange, published March 17, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.06%, the 90th percentile. Fixed in fex 20160919-2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open