What’s Vulnerable › Vulnerabilities

CVE-2020-25538

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-13 · updated 2026-06-17
• Weakness: CWE-94

Description

An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server.

Affected products

• Cmsuno Project Cmsuno: 1.6.2

References

• http://packetstormsecurity.com/files/161162/CMSUno-1.6.2-Remote-Code-Execution.html
• https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution_30.html
• http://packetstormsecurity.com/files/161162/CMSUno-1.6.2-Remote-Code-Execution.html
• https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution_30.html

Get alerted when CVE-2020-25538 or the next vulnerability affects your stack