What’s Vulnerable › Vulnerabilities

CVE-2020-15920

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 98.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-07-24 · updated 2026-06-17
• Weakness: CWE-78

Description

There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.

Affected products

• Midasolutions Eframework: through 2.9.0

References

• http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html
• https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
• http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html
• https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html

Get alerted when CVE-2020-15920 or the next vulnerability affects your stack