CVE-2020-26574

Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a malicious Perl script that will be executed as root via libMisc::browser_client. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

• CWE-79

• https://adepts.of0x.cc/leostream-xss-to-rce/Exploit, Third Party Advisory
• https://www.leostream.com/resources/product-lifecycle/Release Notes, Vendor Advisory
• https://adepts.of0x.cc/leostream-xss-to-rce/Exploit, Third Party Advisory
• https://www.leostream.com/resources/product-lifecycle/Release Notes, Vendor Advisory

Published

Oct 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26567An issue was discovered on D-Link DSR-250N before 3.17B devi…5.5
• CVE-2020-26569In EVPN VxLAN setups in Arista EOS, specific malformed packe…5.9
• CVE-2020-2657Vulnerability in the Oracle CRM Technical Foundation product…4.7
• CVE-2020-26570The Oberthur smart card software driver in OpenSC before 0.2…5.5
• CVE-2020-26571The gemsafe GPK smart card software driver in OpenSC before …5.5
• CVE-2020-26572The TCOS smart card software driver in OpenSC before 0.21.0-…5.5
• CVE-2020-26575In Wireshark through 3.2.7, the Facebook Zero Protocol (aka …7.5
• CVE-2020-2658Vulnerability in the Oracle iSupport product of Oracle E-Bus…8.2
• CVE-2020-26582D-Link DAP-1360U before 3.0.1 devices allow remote authentic…8.8
• CVE-2020-26583An issue was discovered in Sage DPW 2020_06_x before 2020_06…6.1
• CVE-2020-26584An issue was discovered in Sage DPW 2020_06_x before 2020_06…6.1
• CVE-2020-2659Vulnerability in the Java SE, Java SE Embedded product of Or…3.7