Vulnerability · Published Feb 3, 2026 · Assigned by VulnCheck
CVE-2020-37073Victor CMS 1.0 - Authenticated Arbitrary File Upload
High 8.8
In plain English
A high-severity unrestricted file upload in CMSsite from VictorAlagwu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user_image parameter. Attackers can upload a malicious PHP shell to the /img/ directory and execute system commands by accessing the uploaded file with a 'cmd' parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VictorAlagwu | CMSsite | 1.0 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-48490 exploit
- Victor CMS Project Repository product
- VulnCheck Advisory: Victor CMS 1.0 - Authenticated Arbitrary File Upload third-party-advisory