QSearchQSearch

CVE-2020-37246

6.2 MEDIUM

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary f...

Published: 2026-05-16 · Last updated: 2026-05-18

Severity and scoring

CVSS
6.2 MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
CWE-98

Description

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-49954 — Discuz (7.2 HIGH)
  • CVE-2016-20082 — WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by... (6.2 MEDIUM)
  • CVE-2016-20080 — WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenti... (6.2 MEDIUM)
  • CVE-2016-20079 — WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to includ... (6.2 MEDIUM)
  • CVE-2016-20078 — WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary... (6.2 MEDIUM)