CVE-2020-10192

An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_client endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php.

• CWE-79

• https://github.com/munkireport/munkireport-php/releasesRelease Notes, Third Party Advisory
• https://github.com/munkireport/munkireport-php/wiki/20200309-XSS-vulnerabilityExploit, Third Party Advisory
• https://github.com/munkireport/munkireport-php/releasesRelease Notes, Third Party Advisory
• https://github.com/munkireport/munkireport-php/wiki/20200309-XSS-vulnerabilityExploit, Third Party Advisory

Published

Mar 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10187Doorkeeper version 5.0.0 and later contains an information d…7.5
• CVE-2020-10188utility.c in telnetd in netkit telnet through 0.17 allows re…9.8
• CVE-2020-10189Zoho ManageEngine Desktop Central before 10.0.474 allows rem…9.8
• CVE-2020-1019An elevation of privilege vulnerability exists in RMS Sharin…7.8
• CVE-2020-10190An issue was discovered in MunkiReport before 5.3.0. An auth…8.8
• CVE-2020-10191An issue was discovered in MunkiReport before 5.3.0. An auth…5.4
• CVE-2020-10193ESET Archive Support Module before 1294 allows virus-detecti…7.5
• CVE-2020-10194cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox…6.5
• CVE-2020-10195The popup-builder plugin before 3.64.1 for WordPress allows …6.3
• CVE-2020-10196An XSS vulnerability in the popup-builder plugin before 3.64…6.1
• CVE-2020-10199Sonatype Nexus Repository before 3.21.2 allows JavaEL Inject…8.8
• CVE-2020-1020A remote code execution vulnerability exists in Microsoft Wi…8.8