CVE-2020-12635

XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.

• CWE-79

• https://anothernetsecblog.com/magento-2-extension-security/Exploit, Third Party Advisory, URL Repurposed
• https://mageme.com/magento-2-form-builder.htmlProduct, Third Party Advisory
• https://anothernetsecblog.com/magento-2-extension-security/Exploit, Third Party Advisory, URL Repurposed
• https://mageme.com/magento-2-form-builder.htmlProduct, Third Party Advisory

Published

Jun 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12624The League application before 2020-05-02 on Android sends a …6.5
• CVE-2020-12625An issue was discovered in Roundcube Webmail before 1.4.4. T…6.1
• CVE-2020-12626An issue was discovered in Roundcube Webmail before 1.4.4. A…6.5
• CVE-2020-12627Calibre-Web 0.6.6 allows authentication bypass because of th…9.8
• CVE-2020-12629include/class.sla.php in osTicket before 1.14.2 allows XSS v…5.4
• CVE-2020-1263An information disclosure vulnerability exists in the way Wi…5.5
• CVE-2020-12637Zulip Desktop before 5.2.0 has Missing SSL Certificate Valid…9.8
• CVE-2020-12638An encryption-bypass issue was discovered on Espressif ESP-I…6.8
• CVE-2020-12639phpList before 3.5.3 allows XSS, with resultant privilege el…6.1
• CVE-2020-1264An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-12640Roundcube Webmail before 1.4.4 allows attackers to include l…9.8
• CVE-2020-12641rcube_image.php in Roundcube Webmail before 1.4.4 allows att…9.8