{"id":"CVE-2020-18741","aliases":["EUVD-2020-10658","GHSA-cmx5-qh3j-9rhp"],"status":"published","title":"Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any...","description":"Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the \"photoid%5B%5D\" and \"photodesc%5B%5D\" parameters in the component \"index.php?app=photo.\"","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0094,"percentile":0.61242,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2021-07-08T16:29:11Z","modified":"2026-06-17T02:59:26Z","products":[{"vendor":"thinksaas","product":"thinksaas"}],"references":[{"url":"https://github.com/thinksaas/ThinkSAAS/issues/19","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-18741"},{"url":"https://github.com/advisories/GHSA-cmx5-qh3j-9rhp"}],"sources":{"cve":[{"id":"CVE-2020-18741","description":"Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the \"photoid%5B%5D\" and \"photodesc%5B%5D\" parameters in the component \"index.php?app=photo.\"","status":"published","published":"2021-07-08T16:29:11Z","modified":"2024-08-04T14:08:29.77Z","updated_at":"2026-11-02T14:35:59.434367Z"}],"euvd":[{"id":"EUVD-2020-10658","description":"Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the \"photoid%5B%5D\" and \"photodesc%5B%5D\" parameters in the component \"index.php?app=photo.\"","status":"published","published":"2021-07-08T16:29:11Z","modified":"2024-08-04T14:08:29Z","updated_at":"2026-11-03T03:07:26.397496Z"}],"ghsa":[{"id":"GHSA-cmx5-qh3j-9rhp","title":"Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any...","description":"Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the \"photoid%5B%5D\" and \"photodesc%5B%5D\" parameters in the component \"index.php?app=photo.\"","status":"published","published":"2022-05-24T19:07:12Z","modified":"2023-01-27T05:02:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:42:06.943612Z"}],"nvd":[{"id":"CVE-2020-18741","description":"Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the \"photoid%5B%5D\" and \"photodesc%5B%5D\" parameters in the component \"index.php?app=photo.\"","status":"published","published":"2021-07-08T17:15:07.723Z","modified":"2026-06-17T02:59:26.917Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:44.292752Z"}]}}