Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence (../) via the GET parameter file.
Loading...
Loading...
Score 4.9 from GitHub Security Advisory published 2022-05-24. NVD baseline CVSS 4.9; sources differ by 0.0.
Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence (../) via the GET parameter file.
March 12, 2020
November 21, 2024
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.
Working exploit code is in the public domain (1 Exploit-DB entry). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
PHPKB Multi-Language 9 - Authenticated Directory Traversal
Open source ↗See which npm, PyPI, Go, and Maven packages are affected by CVE-2020-10387
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.