CVE-2020-26768

Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site once the URL is clicked or visited. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials, force malware execution, user redirection and others.

• CWE-79

• https://github.com/Formstone/Formstone/issues/286Third Party Advisory
• https://github.com/Formstone/Formstone/issues/286Third Party Advisory

Published

Jan 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2675Vulnerability in the Oracle Hospitality OPERA 5 product of O…7.1
• CVE-2020-26759clickhouse-driver before 0.1.5 allows a malicious clickhouse…9.8
• CVE-2020-2676Vulnerability in the Oracle Hospitality OPERA 5 product of O…6.1
• CVE-2020-26762A stack-based buffer-overflow exists in Edimax IP-Camera IC-…9.8
• CVE-2020-26763The Rocket.Chat desktop application 2.17.11 opens external l…7.5
• CVE-2020-26766A Cross Site Request Forgery (CSRF) vulnerability exists in …8.8
• CVE-2020-2677Vulnerability in the Oracle Hospitality OPERA 5 product of O…5.7
• CVE-2020-26772Command Injection in PPGo_Jobs v2.8.0 allows remote attacker…9.8
• CVE-2020-26773Restaurant Reservation System 1.0 suffers from an authentica…8.8
• CVE-2020-2678Vulnerability in the Oracle VM VirtualBox product of Oracle …6.4
• CVE-2020-2679Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-26797Mediainfo before version 20.08 has a heap buffer overflow vu…7.5