CVE-2020-10103

An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens a specially crafted link to the uploaded file with an active Zammad session.

• CWE-79

• https://zammad.com/news/security-advisory-zaa-2020-02Patch, Vendor Advisory
• https://zammad.com/news/security-advisory-zaa-2020-02Patch, Vendor Advisory

Published

Mar 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10098An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-10099An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-1010An elevation of privilege vulnerability exists in Windows Bl…7.8
• CVE-2020-10100An issue was discovered in Zammad 3.0 through 3.2. It allows…6.5
• CVE-2020-10101An issue was discovered in Zammad 3.0 through 3.2. The WebSo…7.5
• CVE-2020-10102An issue was discovered in Zammad 3.0 through 3.2. The Forgo…5.3
• CVE-2020-10104An issue was discovered in Zammad 3.0 through 3.2. After aut…4.3
• CVE-2020-10105An issue was discovered in Zammad 3.0 through 3.2. It return…5.3
• CVE-2020-10106PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to…9.8
• CVE-2020-10107PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to…5.4
• CVE-2020-10108In Twisted Web through 19.10.0, there was an HTTP request sp…9.8
• CVE-2020-10109In Twisted Web through 19.10.0, there was an HTTP request sp…9.8