CVE-2020-10567

An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.)

• CWE-20

• http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html
• https://github.com/trippo/ResponsiveFilemanager/issues/600Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html
• https://github.com/trippo/ResponsiveFilemanager/issues/600Exploit, Third Party Advisory

Published

Mar 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10561An issue was discovered on Xiaomi Mi Jia ink-jet printer < 3…9.8
• CVE-2020-10562An issue was discovered in DEVOME GRR before 3.4.1c. admin_e…7.2
• CVE-2020-10563An issue was discovered in DEVOME GRR before 3.4.1c. frmcont…9.8
• CVE-2020-10564An issue was discovered in the File Upload plugin before 4.1…9.8
• CVE-2020-10565grub2-bhyve, as used in FreeBSD bhyve before revision 525916…7.8
• CVE-2020-10566grub2-bhyve, as used in FreeBSD bhyve before revision 525916…7.8
• CVE-2020-10568The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.…8.8
• CVE-2020-10569SysAid On-Premise 20.1.11, by default, allows the AJP protoc…9.8
• CVE-2020-1057<p>A remote code execution vulnerability exists in the way t…4.2
• CVE-2020-10570The Telegram application through 5.12 for Android, when Show…6.1
• CVE-2020-10571An issue was discovered in psd-tools before 1.9.4. The Cytho…9.8
• CVE-2020-10573An issue was discovered in Janus through 0.9.1. janus_audiob…7.5