CVE-2020-10392

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-category.php by adding a question mark (?) followed by the payload.

• CWE-79

• http://antoniocannito.it/?p=137#uxssExploit, Third Party Advisory
• https://antoniocannito.it/phpkb1#reflected-cross-site-scripting-in-every-admin-page-cve-block-going-from-cve-2020-10391-to-cve-2020-10456Exploit, Third Party Advisory
• http://antoniocannito.it/?p=137#uxssExploit, Third Party Advisory
• https://antoniocannito.it/phpkb1#reflected-cross-site-scripting-in-every-admin-page-cve-block-going-from-cve-2020-10391-to-cve-2020-10456Exploit, Third Party Advisory

Published

Mar 12, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10387Path Traversal in admin/download.php in Chadha PHPKB Standar…4.9
• CVE-2020-10388The way the Referer header in article.php is handled in Chad…5.4
• CVE-2020-10389admin/save-settings.php in Chadha PHPKB Standard Multi-Langu…7.2
• CVE-2020-1039<p>A remote code execution vulnerability exists when the Win…7.8
• CVE-2020-10390OS Command Injection in export.php (vulnerable function call…7.2
• CVE-2020-10391The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10393The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10394The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10395The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10396The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10397The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10398The way URIs are handled in admin/header.php in Chadha PHPKB…4.8