CVE-2020-18741: Thinksaas

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the "photoid%5B%5D" and "photodesc%5B%5D" parameters in the component "index.php?app=photo."

Affected products

• Thinksaas Thinksaas: version 2.7 only

Published 2021-07-08. Last modified 2026-06-17.