CVE-2020-7935

Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager. An attacker can create a (or use an existing) directory that is externally accessible to store PHP files. The filename and the exact path is known by the attacker, so it is possible to execute PHP code in the context of the application. The vulnerability is exploitable only with Administrator access.

• CWE-434

• https://k4m1ll0.com/cve-2020-7935.htmlExploit, Third Party Advisory
• https://k4m1ll0.com/cve-2020-7935.htmlExploit, Third Party Advisory

Published

Mar 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7927Specially crafted API calls may allow an authenticated user …6.5
• CVE-2020-7928A user authorized to perform database queries may trigger a …6.5
• CVE-2020-7929A user authorized to perform database queries may trigger de…6.5
• CVE-2020-7931In JFrog Artifactory 5.x and 6.x, insecure FreeMarker templa…8.8
• CVE-2020-7932OMERO.web before 5.6.3 optionally allows sensitive data elem…5.7
• CVE-2020-7934In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name…5.4
• CVE-2020-7936An open redirect on the login form (and possibly other place…6.1
• CVE-2020-7937An XSS issue in the title field in Plone 5.0 through 5.2.1 a…5.4
• CVE-2020-7938plone.restapi in Plone 5.2.0 through 5.2.1 allows users with…8.8
• CVE-2020-7939SQL Injection in DTML or in connection objects in Plone 4.0 …8.8
• CVE-2020-7940Missing password strength checks on some forms in Plone 4.3 …7.5
• CVE-2020-7941A privilege escalation issue in plone.app.contenttypes in Pl…9.8