CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous.

• CWE-79

• https://fatihhcelik.blogspot.com/2020/01/rukovoditel-stored-xss.htmlThird Party Advisory
• https://fatihhcelik.blogspot.com/2020/01/rukovoditel-stored-xss.htmlThird Party Advisory

Published

Apr 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11806In MailStore Outlook Add-in (and Email Archive Outlook Add-i…5.9
• CVE-2020-11807Because of Unrestricted Upload of a File with a Dangerous Ty…7.8
• CVE-2020-1181A remote code execution vulnerability exists in Microsoft Sh…8.8
• CVE-2020-11810An issue was discovered in OpenVPN 2.4.x before 2.4.9. An at…3.7
• CVE-2020-11811In qdPM 9.1, an attacker can upload a malicious .php file to…9.8
• CVE-2020-11812Rukovoditel 2.5.2 is affected by a SQL injection vulnerabili…9.8
• CVE-2020-11814A Host Header Injection vulnerability in qdPM 9.1 may allow …5.4
• CVE-2020-11815In Rukovoditel 2.5.2, attackers can upload arbitrary file to…9.8
• CVE-2020-11816Rukovoditel 2.5.2 is affected by a SQL injection vulnerabili…9.8
• CVE-2020-11817In Rukovoditel V2.5.2, attackers can upload an arbitrary fil…9.8
• CVE-2020-11818In Rukovoditel 2.5.2 has a form_session_token value to preve…8.8
• CVE-2020-11819In Rukovoditel 2.5.2, an attacker may inject an arbitrary .p…9.8