CVE-2020-25540
CVE-2020-25540
Vexday Risk Score
82Fix now
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Popular PoC on GitHub (7 stars) — exploitation code widely available.
CVSS —EPSS 75.9%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
14 Sep 2020Published on NVD
15 Sep 2020Public PoC
Weaponization speed
same dayto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Patch as soon as possible — active exploitation confirmed.
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.
Affected products
n/a · n/apublic PoCs found — 9
githubgithub.com/Schira4396/CVE-2020-25540★ 7githubgithub.com/RajChowdhury240/ThinkAdmin-CVE-2020-25540★ 1githubgithub.com/lowkey0808/cve-2020-25540★ 0githubgithub.com/simonlee-hello/CVE-2020-25540★ 0cve_referencepacketstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.htmlunverifiedvulncheckvulncheck.com/xdb/e93468a91b57unverifiedexploitdbwww.exploit-db.com/exploits/48812unverifiedvulncheckvulncheck.com/xdb/09ee10fd9312unverifiedvulncheckvulncheck.com/xdb/4c86945ef500unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.