What’s Vulnerable › Vulnerabilities

CVE-2020-11084: Command Injection in iPear

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-14 · updated 2026-06-17
• Weakness: CWE-78

Description

In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data (files) from the PC.

Affected products

• yaBobJonez iPear: 0.6.14, 0.6.15, 0.7.0

References

• https://github.com/yaBobJonez/iPear/security/advisories/GHSA-4xvp-35fx-hjjj
• https://github.com/yaBobJonez/iPear/security/advisories/GHSA-4xvp-35fx-hjjj

Get alerted when CVE-2020-11084 or the next vulnerability affects your stack