CVE-2020-25879

A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Username' parameter.

• CWE-79

• https://codoforum.com/Product
• https://github.com/r0ck3t1973/xss_payload/issues/5Exploit, Issue Tracking, Third Party Advisory
• https://codoforum.com/Product
• https://github.com/r0ck3t1973/xss_payload/issues/5Exploit, Issue Tracking, Third Party Advisory

Published

Jul 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25872A vulnerability exists within the FileManagerController.php …4.9
• CVE-2020-25873A directory traversal vulnerability in the component system/…6.5
• CVE-2020-25875A stored cross site scripting (XSS) vulnerability in the 'Sm…5.4
• CVE-2020-25876A stored cross site scripting (XSS) vulnerability in the 'Pa…5.4
• CVE-2020-25877A stored cross site scripting (XSS) vulnerability in the 'Ad…5.4
• CVE-2020-25878A stored cross site scripting (XSS) vulnerability in the 'Ad…4.8
• CVE-2020-2588Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-25881A vulnerability was discovered in the filename parameter in …5.5
• CVE-2020-25887Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.…8.8
• CVE-2020-25889Online Bus Booking System Project Using PHP/MySQL version 1.…9.8
• CVE-2020-2589Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-25890The web application of Kyocera printer (ECOSYS M2640IDW) is …6.1