Medium severity5.3NVD Advisory· Published Jul 8, 2021· Updated Jun 17, 2026

CVE-2020-18741

Description

Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the "photoid%5B%5D" and "photodesc%5B%5D" parameters in the component "index.php?app=photo."

Affected products

Thinksaas/ThinkSAAS3 versions
cpe:2.3:a:thinksaas:thinksaas:2.7:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:thinksaas:thinksaas:2.7:*:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: = 2.7

Patches

Vulnerability mechanics

References

github.com/thinksaas/ThinkSAAS/issues/19nvdExploitIssue TrackingThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000