{"metadata": {"vulnerability": "CVE-2020-27387", "count": 36, "kinds": {"milestone": 4, "sighting": 10, "kev": 11, "other": 11}}, "data": [{"timestamp": "2020-10-21T00:00:00Z", "date_only": false, "value": "2020-10-21T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2020-27387", "field": "cveMetadata.dateReserved"}, {"timestamp": "2020-11-05T01:18:12Z", "date_only": false, "value": "2020-11-05T01:18:12+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2020-27387", "field": "timestamps.asserted_at", "uuid": "1678c222-2d82-4dd9-9896-0c91fe881d46", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2020-11-05T01:18:12Z", "date_only": false, "value": "2020-11-05T01:18:12.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2020-27387", "field": "evidence.0.details.added_date", "uuid": "1678c222-2d82-4dd9-9896-0c91fe881d46", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2020-11-05T01:18:12Z", "date_only": false, "value": "2020-11-05T01:18:12+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2020-27387", "field": "timestamps.first_seen_at", "uuid": "1678c222-2d82-4dd9-9896-0c91fe881d46", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2020-11-05T01:18:12Z", "date_only": false, "value": "2020-11-05T01:18:12.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2020-27387", "field": "cveMetadata.datePublished"}, {"timestamp": "2020-11-05T01:18:12Z", "date_only": false, "value": "2020-11-05T01:18:12+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2020-27387", "field": "status.status_updated_at", "uuid": "1678c222-2d82-4dd9-9896-0c91fe881d46", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2020-11-05T02:15:00Z", "date_only": false, "value": "2020-11-05T02:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FMRQ-56MH-96F5", "record": "GHSA-FMRQ-56MH-96F5", "field": "database_specific.nvd_published_at"}, {"timestamp": "2020-11-05T02:15:00Z", "date_only": false, "value": "2020-11-05T02:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2020-27387", "record": "GSD-2020-27387", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2020-11-05T02:15:12.067Z", "date_only": false, "value": "2020-11-05T02:15:12.067", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2020-27387", "record": "FKIE_CVE-2020-27387", "field": "published"}, {"timestamp": "2020-11-05T07:48:14Z", "date_only": false, "value": "2020-11-05T07:48:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/15854", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "198b2c44-70e3-4de3-b9e0-ac0d089d7ae7", "content": "\u203c CVE-2020-27387 \u203c\n\nAn unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/15854"}, {"timestamp": "2020-11-13T12:05:48Z", "date_only": false, "value": "2020-11-13T12:05:48.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/horizontcms_upload_exec.rb", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "8a113f51-f27f-4c15-bdf7-42ad9e6a5655", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/horizontcms_upload_exec.rb"}, {"timestamp": "2020-11-13T17:06:15Z", "date_only": false, "value": "2020-11-13T17:06:15.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2020-27387", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2020-11-16T00:00:00Z", "date_only": true, "value": "2020-11-16", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2020-63981", "record": "CNVD-2020-63981", "field": "submitTime"}, {"timestamp": "2020-11-18T00:00:00Z", "date_only": true, "value": "2020-11-18", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2020-63981", "record": "CNVD-2020-63981", "field": "openTime"}, {"timestamp": "2022-04-05T20:29:14Z", "date_only": false, "value": "2022-04-05T20:29:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/40187", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "9debc23a-ea2c-48e7-8931-05c6998c1685", "content": "\u203c CVE-2021-28428 \u203c\n\nFile upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media Files upload functionality. The original file upload vulnerability (CVE-2020-27387) was remediated by restricting the PHP extensions; however, we confirmed that the filter was bypassed via uploading an arbitrary .htaccess and *.hello files in order to execute PHP code to gain RCE.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/40187"}, {"timestamp": "2022-04-05T20:42:21Z", "date_only": false, "value": "2022-04-05T20:42:21.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/27456", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "4043aa5d-cbeb-47e9-9799-b7c4691f465f", "content": "File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media Files upload functionality. The original file upload vulnerability (CVE-2020-27387) was remediated by restricting the PHP extensions; however, we confirmed that the filter was bypassed via uploading an arbitrary .htaccess and *.hello files in order to execute PHP code to gain RCE.\nPublished at: April 05, 2022 at 06:15PM\nView on website", "url": "https://t.me/VulnerabilityNews/27456"}, {"timestamp": "2022-05-24T17:33:14Z", "date_only": false, "value": "2022-05-24T17:33:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FMRQ-56MH-96F5", "record": "GHSA-FMRQ-56MH-96F5", "field": "published"}, {"timestamp": "2022-10-19T15:58:00Z", "date_only": false, "value": "2022-10-19T15:58Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2020-27387", "record": "GSD-2020-27387", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-10-19T19:00:22Z", "date_only": false, "value": "2022-10-19T19:00:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FMRQ-56MH-96F5", "record": "GHSA-FMRQ-56MH-96F5", "field": "modified"}, {"timestamp": "2023-12-13T01:22:11.484Z", "date_only": false, "value": "2023-12-13T01:22:11.484959Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2020-27387", "record": "GSD-2020-27387", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-04T16:11:36.590Z", "date_only": false, "value": "2024-08-04T16:11:36.590Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2020-27387", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-04T16:11:36.590Z", "date_only": false, "value": "2024-08-04T16:11:36.590Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2020-27387", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-06T03:13:44Z", "date_only": false, "value": "2025-02-06T03:13:44.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "a5d1243a-88f0-4972-9b50-42598583f6ca"}, {"timestamp": "2025-02-23T04:10:27Z", "date_only": false, "value": "2025-02-23T04:10:27.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "90b66a20-c862-4c14-a529-944ccddca606"}, {"timestamp": "2025-07-13T00:00:00Z", "date_only": true, "value": "2025-07-13", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2020-27387", "field": "evidence.0.details.observation_date", "uuid": "50eb7fe0-bb83-40f3-acea-716845276917", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-13T00:00:00Z", "date_only": false, "value": "2025-07-13T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-07-13)", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "5a099b9d-8e22-40a2-a96c-47bab8c977ca"}, {"timestamp": "2025-07-13T11:29:35Z", "date_only": false, "value": "2025-07-13T11:29:35+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2020-27387", "field": "timestamps.asserted_at", "uuid": "50eb7fe0-bb83-40f3-acea-716845276917", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-13T11:29:35Z", "date_only": false, "value": "2025-07-13T11:29:35+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2020-27387", "field": "timestamps.first_seen_at", "uuid": "50eb7fe0-bb83-40f3-acea-716845276917", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-13T11:29:35Z", "date_only": false, "value": "2025-07-13T11:29:35+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2020-27387", "field": "timestamps.last_seen_at", "uuid": "50eb7fe0-bb83-40f3-acea-716845276917", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-13T11:29:35Z", "date_only": false, "value": "2025-07-13T11:29:35+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2020-27387", "field": "status.status_updated_at", "uuid": "50eb7fe0-bb83-40f3-acea-716845276917", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-15T21:02:18.961Z", "date_only": false, "value": "2025-07-15T21:02:18.961799Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3ltzsfqty6n22", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "8aab3663-3ba4-470e-b004-b01d3d7793a2", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3ltzsfqty6n22"}, {"timestamp": "2026-06-17T03:09:12.247Z", "date_only": false, "value": "2026-06-17T03:09:12.247", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2020-27387", "record": "FKIE_CVE-2020-27387", "field": "lastModified"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2020-27387", "field": "timestamps.recorded_at", "uuid": "1678c222-2d82-4dd9-9896-0c91fe881d46", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:06:19.534Z", "date_only": false, "value": "2026-06-23T14:06:19.534589Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1678c222-2d82-4dd9-9896-0c91fe881d46", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "5dbf0bb1-b79d-47a2-8dab-2b9664757fb7", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1678c222-2d82-4dd9-9896-0c91fe881d46"}, {"timestamp": "2026-06-30T11:20:47Z", "date_only": false, "value": "2026-06-30T11:20:47+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2020-27387", "field": "timestamps.recorded_at", "uuid": "50eb7fe0-bb83-40f3-acea-716845276917", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-30T11:39:49.122Z", "date_only": false, "value": "2026-06-30T11:39:49.122486Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/50eb7fe0-bb83-40f3-acea-716845276917", "record": "CVE-2020-27387", "field": "creation_timestamp", "uuid": "0ee1155a-ff60-4a81-9937-be67aaf83de2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/50eb7fe0-bb83-40f3-acea-716845276917"}]}