CVE-2020-23972

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 31.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-08-27 · updated 2026-06-17
Weakness: CWE-434

Description

In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload files which due to issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.

Affected products

Gmapfp: j3.5

References

http://packetstormsecurity.com/files/159072/Joomla-GMapFP-J3.5-J3.5F-Arbitrary-File-Upload.html
https://raw.githubusercontent.com/me4yoursecurity/Reports/master/README.md
http://packetstormsecurity.com/files/159072/Joomla-GMapFP-J3.5-J3.5F-Arbitrary-File-Upload.html
https://raw.githubusercontent.com/me4yoursecurity/Reports/master/README.md

Get alerted when CVE-2020-23972 or the next vulnerability affects your stack