CVE-2020-35734

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab

published February 15, 2021

CVSS
—
EPSS
7%
Percentile
94.0
In the wild
Unconfirmed
What it is

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06772 · 94.0th percentile
Published
2021-02-15T20:49Z
EPSS history
Timeline
  • 15 FEB 20:49Z
    Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab
    cvelistv5