CVE-2020-10212

upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the PATH_INFO. Also, an attacker could create a DNS hostname that resolves to the 0.0.0.0 IP address for DNS pinning. NOTE: this issue exists because of an incomplete fix for CVE-2018-14728.

• CWE-918

• https://github.com/trippo/ResponsiveFilemanager/issues/598Exploit, Issue Tracking, Third Party Advisory
• https://github.com/trippo/ResponsiveFilemanager/issues/598Exploit, Issue Tracking, Third Party Advisory

Published

Mar 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10207Use of Hard-coded Credentials in EntoneWebEngine in Amino Co…9.8
• CVE-2020-10208Command Injection in EntoneWebEngine in Amino Communications…9.9
• CVE-2020-10209Command Injection in the CPE WAN Management Protocol (CWMP) …8.1
• CVE-2020-1021An elevation of privilege vulnerability exists in Windows Er…7.8
• CVE-2020-10210Because of hard-coded SSH keys for the root user in Amino Co…9.8
• CVE-2020-10211A remote code execution vulnerability in UCB component of Mi…9.8
• CVE-2020-10213An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices…8.8
• CVE-2020-10214An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices…8.8
• CVE-2020-10215An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices…8.8
• CVE-2020-10216An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices…8.8
• CVE-2020-10218A Blind SQL Injection issue was discovered in Sapplica Sentr…6.5
• CVE-2020-1022A remote code execution vulnerability exists in Microsoft Dy…8