CVE-2020-14146

KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATH_INFO.

• CWE-79

• https://github.com/KumbiaPHP/KumbiaPHP/releasesRelease Notes, Third Party Advisory
• https://github.com/jenaye/KumbiaPHP-Exploit, Third Party Advisory
• https://github.com/KumbiaPHP/KumbiaPHP/releasesRelease Notes, Third Party Advisory
• https://github.com/jenaye/KumbiaPHP-Exploit, Third Party Advisory

Published

Jun 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14130Some js interfaces in the Xiaomi community were exposed, cau…5.3
• CVE-2020-14131The Xiaomi Security Center expresses heartfelt thanks to ADL…9.8
• CVE-2020-1414An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-14140When Xiaomi router firmware is updated in 2020, there is an …7.5
• CVE-2020-14144The git hook feature in Gitea 1.1.0 through 1.12.5 might all…7.2
• CVE-2020-14145The client side in OpenSSH 5.7 through 8.4 has an Observable…5.9
• CVE-2020-14147An integer overflow in the getnum function in lua_struct.c i…7.7
• CVE-2020-14148The Server-Server protocol implementation in ngIRCd before 2…7.5
• CVE-2020-14149In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the …7.5
• CVE-2020-1415An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-14150GNU Bison before 3.5.4 allows attackers to cause a denial of…5.5
• CVE-2020-14151Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…