CVE-2020-17454

WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal box appears that writes an error message concatenated to the injected payload (without any form of data encoding). This can also be exploited via CSRF.

• CWE-79

• https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0843Vendor Advisory
• https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0843Vendor Advisory

Published

Oct 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17449PHP-Fusion 9.03 allows XSS via the error_log file.5.4
• CVE-2020-1745A file inclusion vulnerability was found in the AJP connecto…9.8
• CVE-2020-17450PHP-Fusion 9.03 allows XSS on the preview page.6.1
• CVE-2020-17451flatCore before 1.5.7 allows XSS by an admin via the acp/acp…4.8
• CVE-2020-17452flatCore before 1.5.7 allows upload and execution of a .php …7.2
• CVE-2020-17453WSO2 Management Console through 5.10 allows XSS via the carb…6.1
• CVE-2020-17456SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code…9.8
• CVE-2020-17457Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An au…5.4
• CVE-2020-17458A post-authenticated stored XSS was found in MultiUx v.3.1.1…5.4
• CVE-2020-1746A flaw was found in the Ansible Engine affecting Ansible Eng…5
• CVE-2020-17462CMS Made Simple 2.2.14 allows Authenticated Arbitrary File U…7.8
• CVE-2020-17463FUEL CMS 1.4.7 allows SQL Injection via the col parameter to…9.8