CVE-2020-18885

2021-08-2013:22:31

mitre

www.cve.org

phpmywind

command injection

remote code execution

web config

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

55.2%

JSON

Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the “text color” field of the component ‘/admin/web_config.php’.

References

cwe.mitre.org/data/definitions/77.html

github.com/gaozhifeng/PHPMyWind/issues/4