CVE-2020-18166: Laobancms

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc".

Affected products

• Laobancms Laobancms: version 2.0 only

Published 2021-05-14. Last modified 2026-06-17.