CVE-2020-19914
MEDIUMCVSS 6.1/10EPSS 0.59%
Last modified
CVE-2020-19914 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function.. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xiuno | Xiunobbs | 4.0.4 |
References
- https://kevinoclam.github.io/blog/2019/07/31/xiunobbs-upload/Exploit, Third Party Advisory
- https://kevinoclam.github.io/blog/2019/07/31/xiunobbs-upload/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-19914?
Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function.
How severe is CVE-2020-19914?
CVE-2020-19914 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.59% probability of exploitation in the next 30 days.
How do I fix CVE-2020-19914?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-19897A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 al…6.1
- CVE-2020-1990A stack-based buffer overflow vulnerability in the managemen…7.2
- CVE-2020-19902Directory Traversal vulnerability found in Cryptoprof WCMS v…9.8
- CVE-2020-19907A command injection vulnerability in the sandcat plugin of C…8.8
- CVE-2020-19909Integer overflow vulnerability in tool_operate.c in curl 7.6…3.3
- CVE-2020-1991An insecure temporary file vulnerability in Palo Alto Networ…7.1
- CVE-2020-19915Cross Site Scripting (XSS vulnerability exists in WUZHI CMS …6.1
- CVE-2020-1992A format string vulnerability in the Varrcvr daemon of PAN-O…9.8
- CVE-2020-19924In Boostnote 0.12.1, exporting to PDF contains opportunities…5.4
- CVE-2020-1993The GlobalProtect Portal feature in PAN-OS does not set a ne…5.4
- CVE-2020-1994A predictable temporary file vulnerability in PAN-OS allows …4.4
- CVE-2020-19947Cross Site Scripting vulnerability found in Markdown Edit al…9.6
Are you affected by CVE-2020-19914?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST