CVE-2020-35657

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS (aka Job Access With Speech) product.

• CWE-434

• https://github.com/jaws-project/jawsThird Party Advisory
• https://github.com/xNoBody12/jaws-rce-via-themeExploit, Third Party Advisory
• https://github.com/jaws-project/jawsThird Party Advisory
• https://github.com/xNoBody12/jaws-rce-via-themeExploit, Third Party Advisory

Published

Dec 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35650Multiple cross-site scripting (XSS) vulnerabilities in Uncan…6.1
• CVE-2020-35652An issue was discovered in res_pjsip_diversion.c in Sangoma …6.5
• CVE-2020-35653In Pillow before 8.1.0, PcxDecode has a buffer over-read whe…7.1
• CVE-2020-35654In Pillow before 8.1.0, TiffDecode has a heap-based buffer o…8.8
• CVE-2020-35655In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer ove…5.4
• CVE-2020-35656Jaws through 1.8.0 allows remote authenticated administrator…7.2
• CVE-2020-35658SpamTitan before 7.09 allows attackers to tamper with backup…5.3
• CVE-2020-35659The DNS query log in Pi-hole before 5.2.2 is vulnerable to s…6.1
• CVE-2020-3566A vulnerability in the Distance Vector Multicast Routing Pro…8.6
• CVE-2020-35660Cross Site Scripting (XSS) in Monica before 2.19.1 via the j…5.4
• CVE-2020-35662In SaltStack Salt before 3002.5, when authenticating to serv…7.4
• CVE-2020-35664An issue was discovered in Acronis Cyber Protect before 15 U…6.1