CVE-2020-11546

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

32.84% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-94

Published

2020-07-14

Updated

2024-08-04

Proof-of-concept exploits (3)

• https://blog.to.com/advisory-superwebmailer-cve-2020-11546/
• Official-BlackHat13/CVE-2020-115461★ · 2021-12-27
• damit5/CVE-2020-115461★ · 2021-12-29

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11546.yaml

Security advisories

• https://blog.to.com/advisory-superwebmailer-cve-2020-11546

References

• CVE Record
• NVD entry