CVE-2020-11084
Command Injection in iPear
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.4EPSS 1.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
14 Jul 2020Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data (files) from the PC.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
yaBobJonez · iPear