CVE-2020-28136

PoC —

CVSS 3.1

8.8 high

EPSS

3%p87

Published

Nov 17, 2020 (Nov 17, 2020)

Modified

Jun 17, 2026

Description

An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page.

Vendors: phpgurukul
Products: tourism management system
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.1%)

In the news0 stories

No ingested article mentions this CVE yet.