CVE-2020-28062

An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath. '/ Upload/Plugins /, which could let a remote malicious user execute arbitrary code.

• CWE-434

• https://github.com/hisiphp/hisiphp/issues/10Exploit, Issue Tracking, Third Party Advisory
• https://github.com/hisiphp/hisiphp/issues/10Exploit, Issue Tracking, Third Party Advisory

Published

Apr 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28050Zoho ManageEngine Desktop Central before build 10.0.647 allo…9.1
• CVE-2020-28052An issue was discovered in Legion of the Bouncy Castle BC Ja…8.1
• CVE-2020-28053HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 all…6.5
• CVE-2020-28054JamoDat TSMManager Collector version up to 6.5.0.21 is vulne…7.5
• CVE-2020-28055A vulnerability in the TCL Android Smart TV series V8-R851T0…7.8
• CVE-2020-2806Vulnerability in the MySQL Server product of Oracle MySQL (c…5.3
• CVE-2020-28063A file upload issue exists in all versions of ArticleCMS whi…9.8
• CVE-2020-2807Vulnerability in the Oracle Marketing Encyclopedia System pr…8.2
• CVE-2020-28070SourceCodester Alumni Management System 1.0 is affected by S…9.8
• CVE-2020-28071SourceCodester Alumni Management System 1.0 is affected by c…4.8
• CVE-2020-28072A Remote Code Execution vulnerability exists in DourceCodest…7.2
• CVE-2020-28073SourceCodester Library Management System 1.0 is affected by …9.8