What’s Vulnerable › Vulnerabilities

CVE-2020-10963

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-03-25 · updated 2026-06-17
• Weakness: CWE-434

Description

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.

Affected products

• Frozennode Laravel-Administrator: through 5.0.12

References

• http://packetstormsecurity.com/files/160243/Laravel-Administrator-4-File-Upload.html
• https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/
• http://packetstormsecurity.com/files/160243/Laravel-Administrator-4-File-Upload.html
• https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/

Get alerted when CVE-2020-10963 or the next vulnerability affects your stack