CVE-2020-5505

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 44.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-01-14 · updated 2026-06-17
Weakness: CWE-78

Description

Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to the /api/files/ URI.

Affected products

Vaaip Freelancy: 1.0.0

References

http://packetstormsecurity.com/files/155922/Freelancy-1.0.0-Remote-Code-Execution.html
http://packetstormsecurity.com/files/155922/Freelancy-1.0.0-Remote-Code-Execution.html

Get alerted when CVE-2020-5505 or the next vulnerability affects your stack