CVE-2020-24949
72Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 67%
from disclosure to weapon267 days
Published on NVDSep 3
1st PoC+267d
VulnCheck+378d
exploitation probability
67%top 1% of all CVEs
observed exploitation
yesVulnCheck
4 public exploit(s)
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).
Affected products
n/a · n/apublic PoCs found — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/49911githubgithub.com/r90tpass/CVE-2020-24949★ 0cve_referencepacketstormsecurity.com/files/162852/PHPFusion-9.03.50-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/315ef377c96cunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.