CVE-2020-10557: Atutor Acontent

High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file manager page contains an arbitrary file upload vulnerability via upload.php. The extension .php7 bypasses file upload restrictions.

Affected products

• Atutor Acontent: up to and including 1.4

Published 2020-03-16. Last modified 2026-06-17.