CVE-2020-23014

APfell 1.4 is vulnerable to authenticated reflected cross-site scripting (XSS) in /apiui/command_ through the payloadtypes_callback function, which allows an attacker to steal remote admin/user session and/or adding new users to the administration panel.

• CWE-79

• https://github.com/its-a-feature/Apfell/commit/5fc64502bc008388514f2b5d1160b677e3b4a7f3Patch, Third Party Advisory
• https://seekurity.com/blog/2020/04/19/admin/advisories/apfell-post-exploitation-red-team-framework-authenticated-cross-site-scripting-vulnerabilityExploit, Third Party Advisory
• https://github.com/its-a-feature/Apfell/commit/5fc64502bc008388514f2b5d1160b677e3b4a7f3Patch, Third Party Advisory
• https://seekurity.com/blog/2020/04/19/admin/advisories/apfell-post-exploitation-red-team-framework-authenticated-cross-site-scripting-vulnerabilityExploit, Third Party Advisory

Published

Jan 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-22985Cross-Site Scripting (XSS) vulnerability in MicroStrategy We…6.1
• CVE-2020-22986Cross-Site Scripting (XSS) vulnerability in MicroStrategy We…6.1
• CVE-2020-22987Cross-Site Scripting (XSS) vulnerability in MicroStrategy We…6.1
• CVE-2020-2299Jenkins Active Directory Plugin 2.19 and earlier allows atta…9.8
• CVE-2020-2300Jenkins Active Directory Plugin 2.19 and earlier does not pr…9.8
• CVE-2020-2301Jenkins Active Directory Plugin 2.19 and earlier allows atta…9.8
• CVE-2020-23015An open redirect issue was discovered in OPNsense through 20…6.1
• CVE-2020-2302A missing permission check in Jenkins Active Directory Plugi…4.3
• CVE-2020-23026A NULL pointer dereference in the main() function dhry_1.c o…7.5
• CVE-2020-2303A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2020-23036MEDIA NAVI Inc SMACom v1.2 was discovered to contain an inse…5.9
• CVE-2020-23037Portable Ltd Playable v9.18 contains a code injection vulner…9.8