CVE-2020-8639

An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. This allows an authenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to a publicly accessible directory of the application.

• CWE-434

• http://packetstormsecurity.com/files/161401/TestLink-1.9.20-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://ackcent.com/blog/testlink-1.9.20-unrestricted-file-upload-and-sql-injection/Exploit, Patch, Third Party Advisory
• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/57d81ae350d569c5c95087997fe051c49e14516dPatch, Third Party Advisory
• http://packetstormsecurity.com/files/161401/TestLink-1.9.20-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://ackcent.com/blog/testlink-1.9.20-unrestricted-file-upload-and-sql-injection/Exploit, Patch, Third Party Advisory
• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/57d81ae350d569c5c95087997fe051c49e14516dPatch, Third Party Advisory

Published

Apr 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8633An issue was discovered in Zimbra Collaboration Suite (ZCS) …5.3
• CVE-2020-8634Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets in…7.8
• CVE-2020-8635Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets in…7.8
• CVE-2020-8636An issue was discovered in OpServices OpMon 9.3.2 that allow…9.8
• CVE-2020-8637A SQL injection vulnerability in TestLink 1.9.20 allows atta…9.8
• CVE-2020-8638A SQL injection vulnerability in TestLink 1.9.20 allows atta…9.8
• CVE-2020-8641Lotus Core CMS 1.0.1 allows authenticated Local File Inclusi…8.8
• CVE-2020-8644PlaySMS before 1.4.3 does not sanitize inputs from a malicio…9.8
• CVE-2020-8645An issue was discovered in Simplejobscript.com SJS through 1…9.8
• CVE-2020-8647There is a use-after-free vulnerability in the Linux kernel …6.1
• CVE-2020-8648There is a use-after-free vulnerability in the Linux kernel …7.1
• CVE-2020-8649There is a use-after-free vulnerability in the Linux kernel …5.9