CVE-2020-24916

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.

• CWE-78

• https://github.com/erlyaws/yaws/commits/masterPatch, Third Party Advisory
• https://github.com/vulnbe/poc-yaws-cgi-shell-injectionExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00022.htmlMailing List, Third Party Advisory
• https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://usn.ubuntu.com/4569-1/Third Party Advisory
• https://vuln.be/post/yaws-xxe-and-shell-injections/Exploit, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4773Third Party Advisory
• https://github.com/erlyaws/yaws/commits/masterPatch, Third Party Advisory
• https://github.com/vulnbe/poc-yaws-cgi-shell-injectionExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00022.htmlMailing List, Third Party Advisory
• https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://usn.ubuntu.com/4569-1/Third Party Advisory
• https://vuln.be/post/yaws-xxe-and-shell-injections/Exploit, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4773Third Party Advisory

Published

Sep 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24904An issue was discovered in attach parameter in GNOME Gmail v…6.5
• CVE-2020-24908Checkmk before 1.6.0p17 allows local users to obtain SYSTEM …7.8
• CVE-2020-2491This cross-site scripting vulnerability in Photo Station all…6.1
• CVE-2020-24912A reflected cross-site scripting (XSS) vulnerability in qcub…6.1
• CVE-2020-24913A SQL injection vulnerability in qcubed (all versions includ…9.8
• CVE-2020-24914A PHP object injection bug in profile.php in qcubed (all ver…9.8
• CVE-2020-24917osTicket before 1.14.3 allows XSS via a crafted filename to …6.1
• CVE-2020-24918A buffer overflow in the RTSP service of the Ambarella Oryx …9.8
• CVE-2020-2492If exploited, the command injection vulnerability could allo…7.2
• CVE-2020-24922Cross Site Request Forgery (CSRF) vulnerability in xxl-job-a…8.8
• CVE-2020-24924A Persistent Cross-site Scripting vulnerability is found in …5.4
• CVE-2020-24925A Sensitive Source Code Path Disclosure vulnerability is fou…7.5