CVE-2020-10455

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/translate.php by adding a question mark (?) followed by the payload.

• CWE-79

• http://antoniocannito.it/?p=137#uxssExploit, Third Party Advisory
• https://antoniocannito.it/phpkb1#reflected-cross-site-scripting-in-every-admin-page-cve-block-going-from-cve-2020-10391-to-cve-2020-10456Exploit, Third Party Advisory
• http://antoniocannito.it/?p=137#uxssExploit, Third Party Advisory
• https://antoniocannito.it/phpkb1#reflected-cross-site-scripting-in-every-admin-page-cve-block-going-from-cve-2020-10391-to-cve-2020-10456Exploit, Third Party Advisory

Published

Mar 12, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1045<p>A security feature bypass vulnerability exists in the way…7.5
• CVE-2020-10450The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10451The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10452The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10453The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10454The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10456The way URIs are handled in admin/header.php in Chadha PHPKB…4.8
• CVE-2020-10457Path Traversal in admin/imagepaster/image-renaming.php in Ch…2.7
• CVE-2020-10458Path Traversal in admin/imagepaster/operations.php in Chadha…6.5
• CVE-2020-10459Path Traversal in admin/assetmanager/assetmanager.php (vulne…2.7
• CVE-2020-1046A remote code execution vulnerability exists when Microsoft …7.8
• CVE-2020-10460admin/include/operations.php (via admin/email-harvester.php)…4.9