CVE-2020-13821

An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the session and cookie of the administrator's account of the Broker.

• CWE-79

• https://payatu.com/advisory/hivemq-mqtt-broker---xss-over-mqttThird Party Advisory
• https://www.hivemq.com/blog/hivemq-4-3-3-released/Release Notes, Vendor Advisory
• https://payatu.com/advisory/hivemq-mqtt-broker---xss-over-mqttThird Party Advisory
• https://www.hivemq.com/blog/hivemq-4-3-3-released/Release Notes, Vendor Advisory

Published

Aug 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13816Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13817ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows …7.4
• CVE-2020-13818In Zoho ManageEngine OpManager before 125144, when <cachesta…7.5
• CVE-2020-13819Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflec…6.1
• CVE-2020-1382An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-13820Extreme Management Center 8.4.1.24 allows unauthenticated re…6.1
• CVE-2020-13822The Elliptic package 6.5.2 for Node.js allows ECDSA signatur…7.7
• CVE-2020-13825A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 …6.1
• CVE-2020-13826A CSV injection (aka Excel Macro Injection or Formula Inject…8.8
• CVE-2020-13827phpList before 3.5.4 allows XSS via /lists/admin/user.php an…6.1
• CVE-2020-13828Dolibarr 11.0.4 is affected by multiple stored Cross-Site Sc…5.4
• CVE-2020-13829An issue was discovered on Samsung mobile devices with P(9.0…7.5