9.4 CriticalCWE-434
CVE-2025-0520
ShowDoc vulnerability
Status
- Not in CISA KEV
- Fixed in version 2.8.7
Exploit probabilityEPSSchecked 25 Oct
2.6%probability of exploitation in the next 30 days
Higher than 86% of scored CVEs
SeverityCVSS
9.4Critical
Description NVD
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 14 Apr · 06:28 UTC | The Hacker News | ShowDoc flaw CVE-2025-0520 exploited, hackers drop web shells |
| Tue 14 Apr · 10:28 UTC | Security Affairs | ShowDoc Flaw CVE-2025-0520 Exposes Thousands to RCE Attacks |
- ShowDoc Flaw CVE-2025-0520 Exposes Thousands to RCE AttacksSecurity Affairs
- ShowDoc flaw CVE-2025-0520 exploited, hackers drop web shellsThe Hacker News · first in our coverage