CVE-2020-28000 to CVE-2020-28999

236 CVEs with public proof-of-concept exploits.

• CVE-2020-280012 PoCsSolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.
• CVE-2020-280051 PoChttpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buffer overflow…
• CVE-2020-280081 PoCExim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a…
• CVE-2020-280184 PoCsExim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.
• CVE-2020-280202 PoCsExim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by…
• CVE-2020-280301 PoCIn Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the…
• CVE-2020-280321 PoCWordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
• CVE-2020-280411 PoCThe SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP…
• CVE-2020-280422 PoCsServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes…
• CVE-2020-280471 PoCAudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). If the recommended security configuration parameter…
• CVE-2020-280522 PoCsAn issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared…
• CVE-2020-280552 PoCsA vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group…
• CVE-2020-280621 PoCAn Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath. '/…
• CVE-2020-280701 PoCSourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in…
• CVE-2020-280711 PoCSourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php. After the admin…
• CVE-2020-280721 PoCA Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload…
• CVE-2020-280731 PoCSourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and…
• CVE-2020-280912 PoCscxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php.
• CVE-2020-280922 PoCsPESCMS Team 2.3.2 has multiple reflected XSS via the id…
• CVE-2020-280971 PoCThe vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read…
• CVE-2020-281191 PoCCross site scripting vulnerability in 53KF < 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted…
• CVE-2020-281291 PoCStored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary…
• CVE-2020-281301 PoCAn Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct…
• CVE-2020-281331 PoCAn issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web…
• CVE-2020-281361 PoCAn Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution…
• CVE-2020-281371 PoCCross site request forgery (CSRF) in Genexis Platinum 4410 V2-1.28, allows attackers to cause a denial of service by continuously…
• CVE-2020-281381 PoCSourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php.
• CVE-2020-281391 PoCSourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php.
• CVE-2020-281401 PoCSourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php.
• CVE-2020-281411 PoCThe messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send…
• CVE-2020-281451 PoCArbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows…
• CVE-2020-281462 PoCsCross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.
• CVE-2020-281491 PoCmyDBR 5.8.3/4262 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: CSRF Token…
• CVE-2020-281501 PoCI-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses…
• CVE-2020-281694 PoCsThe td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a…
• CVE-2020-281721 PoCA SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication…
• CVE-2020-281731 PoCSimple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a…
• CVE-2020-281831 PoCSQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php.
• CVE-2020-281841 PoCCross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or…
• CVE-2020-281853 PoCsUser Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the…
• CVE-2020-281861 PoCEmail Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and…
• CVE-2020-281873 PoCsMultiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any…
• CVE-2020-281887 PoCsRemote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via…
• CVE-2020-281901 PoCTerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP)…
• CVE-2020-281982 PoCsThe 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to…
• CVE-2020-281991 PoCbest it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor.
• CVE-2020-282061 PoCAn issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive…
• CVE-2020-282087 PoCsAn email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
• CVE-2020-282411 PoClibmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
• CVE-2020-282432 PoCsAn issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted…
• CVE-2020-282492 PoCsJoplin 1.2.6 for Desktop allows XSS via a LINK element in a note.
• CVE-2020-282681 PoCPrototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may…
• CVE-2020-282691 PoCPrototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to…
• CVE-2020-282701 PoCPrototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service…
• CVE-2020-282711 PoCPrototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to…
• CVE-2020-282722 PoCsPrototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to…
• CVE-2020-282731 PoCPrototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to…
• CVE-2020-282761 PoCPrototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to…
• CVE-2020-282772 PoCsPrototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to…
• CVE-2020-282781 PoCPrototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to…
• CVE-2020-282792 PoCsPrototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may…
• CVE-2020-282821 PoCPrototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code…
• CVE-2020-283285 PoCsSuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances…
• CVE-2020-283291 PoCBarco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A…
• CVE-2020-283301 PoCBarco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with…
• CVE-2020-283322 PoCsBarco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19…
• CVE-2020-283342 PoCsBarco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19…
• CVE-2020-283373 PoCsA directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code…
• CVE-2020-283473 PoCstdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter…
• CVE-2020-283491 PoCAn inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of…
• CVE-2020-283514 PoCsThe conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected…
• CVE-2020-283611 PoCKamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a…
• CVE-2020-283731 PoCupnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects…
• CVE-2020-284133 PoCsIn MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.
• CVE-2020-284231 PoCCommand Injection
• CVE-2020-284241 PoCCommand Injection
• CVE-2020-284251 PoCCommand Injection
• CVE-2020-284261 PoCCommand Injection
• CVE-2020-284292 PoCsCommand Injection
• CVE-2020-284331 PoCCommand Injection
• CVE-2020-284341 PoCCommand Injection
• CVE-2020-284351 PoCCommand Injection
• CVE-2020-284361 PoCCommand Injection
• CVE-2020-284371 PoCCommand Injection
• CVE-2020-284381 PoCCommand Injection
• CVE-2020-284411 PoCPrototype Pollution
• CVE-2020-284423 PoCsPrototype Pollution
• CVE-2020-284431 PoCCommand Injection
• CVE-2020-284451 PoCCommand Injection
• CVE-2020-284461 PoCCommand Injection
• CVE-2020-284471 PoCCommand Injection
• CVE-2020-284482 PoCsPrototype Pollution
• CVE-2020-284491 PoCPrototype Pollution
• CVE-2020-284501 PoCPrototype Pollution
• CVE-2020-284511 PoCCommand Injection
• CVE-2020-284531 PoCCommand Injection
• CVE-2020-284551 PoCCross-site Scripting (XSS)
• CVE-2020-284561 PoCCross-site Scripting (XSS)
• CVE-2020-284583 PoCsPrototype Pollution
• CVE-2020-284591 PoCCross-site Scripting (XSS)
• CVE-2020-284601 PoCPrototype Pollution
• CVE-2020-284611 PoCPrototype Pollution
• CVE-2020-284621 PoCPrototype Pollution
• CVE-2020-284632 PoCsServer-side Request Forgery (SSRF)
• CVE-2020-284641 PoCRemote Code Execution (RCE)
• CVE-2020-284682 PoCsImproper Control of Generation of Code ('Code Injection')
• CVE-2020-284693 PoCsRegular Expression Denial of Service (ReDoS)
• CVE-2020-284712 PoCsPrototype Pollution
• CVE-2020-284724 PoCsPrototype Pollution
• CVE-2020-284731 PoCWeb Cache Poisoning
• CVE-2020-284772 PoCsPrototype Pollution
• CVE-2020-284782 PoCsPrototype Pollution
• CVE-2020-284811 PoCInsecure Defaults
• CVE-2020-284873 PoCsCross-site Scripting (XSS)
• CVE-2020-284931 PoCRegular Expression Denial of Service (ReDoS)
• CVE-2020-284941 PoCCommand Injection
• CVE-2020-284951 PoCPrototype Pollution
• CVE-2020-284963 PoCsRegular Expression Denial of Service (ReDoS)
• CVE-2020-285007 PoCsRegular Expression Denial of Service (ReDoS)
• CVE-2020-285026 PoCsArbitrary Code Injection
• CVE-2020-285032 PoCsPrototype Pollution
• CVE-2020-285741 PoCA unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could…
• CVE-2020-285781 PoCA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a…
• CVE-2020-285791 PoCA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a…
• CVE-2020-285801 PoCA command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an…
• CVE-2020-285811 PoCA command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an…
• CVE-2020-285871 PoCA specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an…
• CVE-2020-285881 PoCAn information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More…
• CVE-2020-285891 PoCAn improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader…
• CVE-2020-285901 PoCAn out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master…
• CVE-2020-285911 PoCAn out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and…
• CVE-2020-285921 PoCA heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer…
• CVE-2020-285931 PoCA unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A…
• CVE-2020-285941 PoCA use-after-free vulnerability exists in the _3MF_Importer::_handle_end_model() functionality of Prusa Research PrusaSlicer 2.2.0 and…
• CVE-2020-285951 PoCAn out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit…
• CVE-2020-285961 PoCA stack-based buffer overflow vulnerability exists in the Objparser::objparse() functionality of Prusa Research PrusaSlicer 2.2.0 and…
• CVE-2020-285981 PoCAn out-of-bounds write vulnerability exists in the Admesh stl_fix_normal_directions() functionality of Prusa Research PrusaSlicer 2.2.0…
• CVE-2020-285991 PoCA stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A…
• CVE-2020-286001 PoCAn out-of-bounds write vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially…
• CVE-2020-286021 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286031 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286041 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286051 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286061 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286071 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286081 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286091 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286101 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286111 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286121 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286131 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286141 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286151 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286161 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286171 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286181 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286191 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286201 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286211 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286221 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286231 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286241 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286251 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286261 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286271 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286281 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286291 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286301 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286311 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286321 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286331 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286341 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286351 PoCMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted…
• CVE-2020-286421 PoCIn InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote…
• CVE-2020-286472 PoCsIn Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the…
• CVE-2020-286482 PoCsImproper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
• CVE-2020-286536 PoCsZoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart…
• CVE-2020-286721 PoCMonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution. At monofiles/category.php:27…
• CVE-2020-286872 PoCsThe edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.
• CVE-2020-286882 PoCsThe add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.
• CVE-2020-286951 PoCAskey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to…
• CVE-2020-287051 PoCFUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
• CVE-2020-287071 PoCThe Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via…
• CVE-2020-287171 PoCCross Site Scripting (XSS) vulnerability in content1 parameter in demo.jsp in kindsoft kindeditor version 4.1.12, allows attackers to…
• CVE-2020-287221 PoCDeskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vulnerability that can lead to…
• CVE-2020-287591 PoCThe serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash. NOTE: another person has stated "I don't think there is…
• CVE-2020-288381 PoCCross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart.
• CVE-2020-288401 PoCBuffer Overflow vulnerability in jpgfile.c in Matthias-Wandel jhead version 3.04, allows local attackers to execute arbitrary code and…
• CVE-2020-288411 PoCMyDrivers64.sys in DriverGenius 9.61.3708.3054 allows attackers to cause a system crash via the ioctl command 0x9c402000 to…
• CVE-2020-288451 PoCA CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's…
• CVE-2020-288491 PoCCross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive…
• CVE-2020-288571 PoCOpenAsset Digital Asset Management (DAM) through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and…
• CVE-2020-288581 PoCOpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was…
• CVE-2020-288602 PoCsOpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL…
• CVE-2020-288612 PoCsOpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing…
• CVE-2020-288701 PoCIn InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in…
• CVE-2020-288714 PoCsRemote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an…
• CVE-2020-288722 PoCsAn authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized…
• CVE-2020-288741 PoCreset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are…
• CVE-2020-288773 PoCsBuffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400…
• CVE-2020-289001 PoCInsufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of…
• CVE-2020-289011 PoCCommand Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to…
• CVE-2020-289021 PoCCommand Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.
• CVE-2020-289031 PoCImproper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary…
• CVE-2020-289041 PoCExecution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a…
• CVE-2020-289051 PoCImproper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.
• CVE-2020-289071 PoCIncorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via…
• CVE-2020-289081 PoCCommand Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.
• CVE-2020-289091 PoCIncorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts…
• CVE-2020-289101 PoCCreation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of…
• CVE-2020-289111 PoCIncorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage…
• CVE-2020-289261 PoCReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA…
• CVE-2020-289271 PoCThere is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin…
• CVE-2020-289371 PoCOpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's…
• CVE-2020-289381 PoCOpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions…
• CVE-2020-289391 PoCOpenClinic version 0.8.2 is affected by a medical/test_new.php insecure file upload vulnerability. This vulnerability allows authenticated…
• CVE-2020-289431 PoCOX App Suite 7.10.4 and earlier allows SSRF via a snippet.
• CVE-2020-289451 PoCOX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as…
• CVE-2020-289484 PoCsArchive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
• CVE-2020-289495 PoCsKEVArchive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as…
• CVE-2020-289551 PoCSugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability…
• CVE-2020-289561 PoCMultiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web…
• CVE-2020-289571 PoCMultiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary…
• CVE-2020-289601 PoCChichen Tech CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the file product_list.php via the id and cid…
• CVE-2020-289611 PoCPerfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the…
• CVE-2020-289631 PoCPasscovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function.
• CVE-2020-289641 PoCInternet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Search function. This vulnerability allows…
• CVE-2020-289671 PoCFlashGet v1.9.6 was discovered to contain a buffer overflow in the 'current path directory' function. This vulnerability allows attackers…
• CVE-2020-289681 PoCDraytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration…
• CVE-2020-289741 PoCA slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or…
• CVE-2020-289752 PoCssvm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and other products, allows attackers to cause a denial of…
• CVE-2020-289762 PoCsThe Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any…
• CVE-2020-289771 PoCThe Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any…
• CVE-2020-289781 PoCThe Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any…
• CVE-2020-289931 PoCA Directory Traversal vulnerability exists in ATX miniCMTS200a Broadband Gateway through 2.0 and Pico CMTS through 2.0. Successful…
• CVE-2020-289941 PoCA SQL injection vulnerability was discovered in Karenderia Multiple Restaurant System, affecting versions 5.4.2 and below. The…