cve-2020-27387

{
  "cvss": 0.0,
  "datePublished": "2025-07-13T00:00:00Z",
  "dateUpdated": "2025-07-13T00:00:00Z",
  "description": "An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.",
  "dueDate": "",
  "id": "CVE-2020-27387",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "horizontcms",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "HIGH",
  "source": "vulncheck_kev",
  "title": "horizontcms_project horizontcms Unrestricted Upload of File with Dangerous Type",
  "vendor": "horizontcms_project"
}