CVE-2020-10101

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process.

• CWE-20
• CWE-755

• https://zammad.com/news/security-advisory-zaa-2020-06Patch, Vendor Advisory
• https://zammad.com/news/security-advisory-zaa-2020-06Patch, Vendor Advisory

Published

Mar 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10096An issue was discovered in Zammad 3.0 through 3.2. It does n…7.5
• CVE-2020-10097An issue was discovered in Zammad 3.0 through 3.2. It may re…5.3
• CVE-2020-10098An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-10099An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-1010An elevation of privilege vulnerability exists in Windows Bl…7.8
• CVE-2020-10100An issue was discovered in Zammad 3.0 through 3.2. It allows…6.5
• CVE-2020-10102An issue was discovered in Zammad 3.0 through 3.2. The Forgo…5.3
• CVE-2020-10103An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-10104An issue was discovered in Zammad 3.0 through 3.2. After aut…4.3
• CVE-2020-10105An issue was discovered in Zammad 3.0 through 3.2. It return…5.3
• CVE-2020-10106PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to…9.8
• CVE-2020-10107PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to…5.4