Vulnerability · Published Jan 27, 2026 · Assigned by VulnCheck
CVE-2020-36942Victor CMS 1.0 - File Upload To RCE
High 8.8
In plain English
A high-severity unrestricted file upload in CMSsite from VictorAlagwu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 46.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Attackers can upload a PHP shell to the /img directory and execute system commands by accessing the uploaded file via web browser.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VictorAlagwu | CMSsite | 1.0 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-49310 exploit
- Victor CMS Project Repository product
- VulnCheck Advisory: Victor CMS 1.0 - File Upload To RCE third-party-advisory