CVE-2020-25790 - CVE House
Back to Database
Status published High CVE-2020-25790

Typesetter CMS 5.x through 5.1 allows admins to upload and...

Vulnerability Description

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being fixed for 5.2

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-25790

Credits & Attribution

No credits recorded in the NVD database.

References

More from typesettercms

View All →
CVE-2022-25523
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery...
High 8.8
CVE-2020-35126
Typesetter CMS 5.x through 5.1 allows admins to conduct Site...
Medium 4.8
CVE-2020-19511
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1)...
Medium 6.1
CVE-2019-20077
The Typesetter CMS 5.1 logout functionality is affected by a...
Medium 4.3
CVE-2018-6889
An issue was discovered in Typesetter 5.1. It suffers from...
High 8.8

Affected Vendor

typesettercms

View all reports →

Affected Software

typesetter
Vulnerable Versions:
5.0

Timeline

Official Publish: September 19th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.