High severity7.5NVD Advisory· Published Aug 27, 2020· Updated Jun 17, 2026

CVE-2020-23972

Description

In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload files which due to issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Gmapfp/Gmapfp2 versions
cpe:2.3:a:gmapfp:gmapfp:j3.5:*:*:*:-:joomla\!:*:*+ 1 more
- cpe:2.3:a:gmapfp:gmapfp:j3.5:*:*:*:-:joomla\!:*:*
- cpe:2.3:a:gmapfp:gmapfp:j3.5:*:*:*:free:joomla\!:*:*
Joomla/GMapFPdescription
Joomla/GMapFPllm-fuzzy
Range: J3.5, J3.5free

Patches

Vulnerability mechanics

References

raw.githubusercontent.com/me4yoursecurity/Reports/master/README.mdnvdExploitThird Party Advisory
packetstormsecurity.com/files/159072/Joomla-GMapFP-J3.5-J3.5F-Arbitrary-File-Upload.htmlnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.025
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000