CVE-2016-20052 is a critical unrestricted file upload vulnerability affecting Snews CMS 1.7, enabling unauthenticated attackers to upload arbitrary PHP files to the snews_files directory and achieve remote code execution. Rated with a CVSS score of 9.8 (CRITICAL), it poses a significant threat due to its network attack vector, low attack complexity, and lack of required privileges or user interaction, leading to high impact across confidentiality, integrity, and availability. Although not listed in CISA's KEV catalog, this vulnerability is on an active "Hot List" and has received some community attention, including recent social media mentions. No public exploit code is currently available in Metasploit, Nuclei, or ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.7CPE matchmatch criteria | cpe:2.3:a:snewscms:snews:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.