CVE-2020-37227

Description

HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution.

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

8.8 / 10

CVSS vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Effective score

8.8 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2020-37227

Linked Threat

CVE-2020-37227 — Helios Solutions Brand Logo Slider <= 2.1 - Authenticated (Admin+) Arbitrary File Upload

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-05-16 16:16:17 UTC

NVD last modified

2026-05-18 17:32:04 UTC

NVD CVSS v3.1

8.8 / 10 HIGH source: disclosure@vulncheck.com

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

2.8 / 10

Impact subscore

5.9 / 10

EPSS score

0.0010 (probability of exploitation in next 30 days)

EPSS percentile

28.01% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD-assigned CWE(s): CWE-434 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2020-31228

Assigner

VulnCheck

Published

May 16, 2026, 3:25:45 PM

Updated

May 18, 2026, 6:14:00 PM

EUVD base score (CVSS 4.0)

8.7 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EUVD-reported EPSS

0.1100

Vendors

Heliossolutions

Products

HS Brand Logo Slider (2.1)

Aliases

GHSA-7487-8952-hmfc

ENISA description: HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (7)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://ms.wordpress.org/plugins/hs-brand-logo-slider/ tenable:ms.wordpress.org
• https://nvd.nist.gov/vuln/detail/CVE-2020-37227 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2020-37227 tenable:www.cve.org
• https://www.exploit-db.com/exploits/48913 tenable:www.exploit-db.com
• https://www.first.org/epss/ tenable:www.first.org
• https://www.heliossolutions.co/ tenable:www.heliossolutions.co
• https://www.vulncheck.com/advisories/wordpress-plugin-hs-brand-logo-slider-unrestricted-file-upload tenable:www.vulncheck.com

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Wordfence remediation: Helios Solutions Brand Logo Slider
  Wordfence

  No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

  2026-07-30 02:53 UTC
• NVD - Home
  web:nvd.nist.gov

  The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

  2026-05-26 02:54 UTC
• How to Use Known Issue Rollback to Fix Problems Caused by Windows ...
  web:petri.com

  How to Fix Issues Caused by Windows Cumulative Updates using Known Issue Rollback (Image Credit: Microsoft) KIR works at the code level.

  2026-05-26 02:54 UTC
• January 24, 2026—KB5078127 (OS Builds 26200.7628 and 26100.7628) Out-of ...
  web:support.microsoft.com

  It includes updates from previous security and non-security releases, along with an additional fix . To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained.

  2026-05-26 02:54 UTC
• Microsoft releases emergency patches for critical ASP.NET flaw
  web:www.bleepingcomputer.com

  Microsoft has released out-of-band (OOB) security updates to patch a critical ASP.NET Core privilege escalation vulnerability.

  2026-05-26 02:54 UTC
• Microsoft Patch Tuesday March 2026 - 78 Vulnerabilities Fixed ...
  web:cybersecuritynews.com

  Microsoft released its March 2026 Patch Tuesday security update on March 10, 2026, addressing 78 vulnerabilities across Windows, Microsoft Office, Azure, SQL Server, and .NET. The update includes one actively exploited zero-day vulnerability and multiple Critical-rated flaws demanding immediate attention from security teams. The most urgent fix this month is CVE -2026-21262, the sole zero-day ...

  2026-05-26 02:54 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-05-26 02:54 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

  2026-05-26 02:54 UTC
• Microsoft fixes 167 security flaws in April, second biggest Patch ...
  web:www.pcworld.com

  This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

  2026-05-26 02:54 UTC
• Microsoft issues SECOND emergency out of band update for Windows 11 to ...
  web:www.windowscentral.com

  Another out of band update has been issued to Windows 11 users to address a major bug that caused Outlook to become inoperable after January's disastrous Patch Tuesday updates.

  2026-05-26 02:54 UTC
• Microsoft Releases Out-of-Band Security Update to Mitigate ... - CISA
  web:www.cisa.gov

  Updated October 29, 2025: CISA has updated this Alert to include revised information on vulnerable product identification, potential threat activity detections, and additional resources. Microsoft released an update to address a critical remote code execution vulnerability impacting Windows Server Update Service (WSUS) in Windows Server (2012, 2016, 2019, 2022, and 2025), CVE -2025-59287

  2026-05-26 02:54 UTC

Only Available for Registered Users. Sign in to view.