CVE-2020-13260

A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as the static key file in Configuration-Services-Security-OpenVPN-Static Keys. This payload will execute each time a user opens an affected web page. This could be exploited in conjunction with CVE-2020-13259.

• CWE-79
• CWE-434

• https://cxsecurity.com/issue/WLB-2020090063Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/48807Exploit, Third Party Advisory, VDB Entry
• https://www.rad.com/products/secflow-1v-IIoT-Gateway#panels-ipe-paneid-143837Product, Vendor Advisory
• https://cxsecurity.com/issue/WLB-2020090063Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/48807Exploit, Third Party Advisory, VDB Entry
• https://www.rad.com/products/secflow-1v-IIoT-Gateway#panels-ipe-paneid-143837Product, Vendor Advisory

Published

Sep 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13252Centreon before 19.04.15 allows remote attackers to execute …8.8
• CVE-2020-13253sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated a…5.5
• CVE-2020-13254An issue was discovered in Django 2.2 before 2.2.13 and 3.0 …5.9
• CVE-2020-13258Contentful through 2020-05-21 for Python allows reflected XS…6.1
• CVE-2020-13259A vulnerability in the web-based management interface of RAD…8.8
• CVE-2020-1326A Cross-site Scripting (XSS) vulnerability exists when Azure…5.4
• CVE-2020-13261Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and l…2.7
• CVE-2020-13262Client-Side code injection through Mermaid markup in GitLab …6.1
• CVE-2020-13263An authorization issue relating to project maintainer impers…8.8
• CVE-2020-13264Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and…5.3
• CVE-2020-13265User email verification bypass in GitLab CE/EE 12.5 and late…5.3
• CVE-2020-13266Insecure authorization in Project Deploy Keys in GitLab CE/E…4.3