CVE-2020-19137

Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10".

• CWE-312

• https://github.com/ShuaiJunlan/Autumn/issues/82Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/ShuaiJunlan/Autumn/issues/82Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Sep 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-19113Arbitrary File Upload vulnerability in Online Book Store v1.…9.8
• CVE-2020-19114SQL Injection vulnerability in Online Book Store v1.0 via th…9.8
• CVE-2020-19118Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via th…5.4
• CVE-2020-1912An out-of-bounds read/write vulnerability when executing laz…8.1
• CVE-2020-1913An Integer signedness error in the JavaScript Interpreter in…8.1
• CVE-2020-19131Buffer Overflow in LibTiff v4.0.10 allows attackers to cause…7.5
• CVE-2020-19138Unrestricted Upload of File with Dangerous Type in DotCMS v5…9.8
• CVE-2020-1914A logic vulnerability when handling the SaveGeneratorLong in…9.8
• CVE-2020-19142iCMS 7 attackers to execute arbitrary OS commands via shell …9.8
• CVE-2020-19143Buffer Overflow in LibTiff v4.0.10 allows attackers to cause…6.5
• CVE-2020-19144Buffer Overflow in LibTiff v4.0.10 allows attackers to cause…6.5
• CVE-2020-19146Improper Access Control in Jfinal CMS v4.7.1 and earlier all…6.5