CVE-2020-13589

An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entities_id parameter in the 'entities/fields page (mulitple_edit or copy_selected or export function) is vulnerable to authenticated SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.

• CWE-89
• CWE-89

• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1199Exploit, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1199Exploit, Third Party Advisory

Published

Aug 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13583A denial-of-service vulnerability exists in the HTTP Server …7.5
• CVE-2020-13584An exploitable use-after-free vulnerability exists in WebKit…8.8
• CVE-2020-13585An out-of-bounds write vulnerability exists in the PSD Heade…8.8
• CVE-2020-13586A memory corruption vulnerability exists in the Excel Docume…7.8
• CVE-2020-13587An exploitable SQL injection vulnerability exists in the "fo…8.8
• CVE-2020-13588An exploitable SQL injection vulnerability exists in the ‘en…8.8
• CVE-2020-1359An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-13590Multiple exploitable SQL injection vulnerabilities exist in …7.2
• CVE-2020-13591An exploitable SQL injection vulnerability exists in the "ac…8.8
• CVE-2020-13592An exploitable SQL injection vulnerability exists in "global…8.8
• CVE-2020-13593The Bluetooth Low Energy Secure Manager Protocol (SMP) imple…8.8
• CVE-2020-13594The Bluetooth Low Energy (BLE) controller implementation in …6.5