CVE-2020-10963

PoC —

CVSS 3.1

7.2 high

EPSS

15%p96

Published

Mar 25, 2020 (Mar 25, 2020)

Modified

Jun 17, 2026

Description

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.

Vendors: frozennode
Products: laravel-administrator
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (14.7%)

In the news0 stories

No ingested article mentions this CVE yet.