CVE-2020-26885

An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a malicious URL that executes a JavaScript payload in a victim's browser.

• CWE-79

• http://burninatorsec.blogspot.com/2021/04/cve-2020-26885-xss-in-2sxc.html?m=1Exploit, Third Party Advisory
• https://2SXC.org/en/blog/post/2sxc-security-notification-2021-001Vendor Advisory
• https://burninatorsec.blogspot.com/2020/10/cve-2020-26885-xss-in-anchor-tags.htmlExploit, Third Party Advisory
• https://github.com/2sic/2sxc/releasesThird Party Advisory
• http://burninatorsec.blogspot.com/2021/04/cve-2020-26885-xss-in-2sxc.html?m=1Exploit, Third Party Advisory
• https://2SXC.org/en/blog/post/2sxc-security-notification-2021-001Vendor Advisory
• https://burninatorsec.blogspot.com/2020/10/cve-2020-26885-xss-in-anchor-tags.htmlExploit, Third Party Advisory
• https://github.com/2sic/2sxc/releasesThird Party Advisory

Published

Jun 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26879Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is …9.8
• CVE-2020-2688Vulnerability in the Oracle Financial Services Analytical Ap…7.1
• CVE-2020-26880Sympa through 6.2.57b.2 allows a local privilege escalation …7.8
• CVE-2020-26882In Play Framework 2.6.0 through 2.8.2, data amplification ca…7.5
• CVE-2020-26883In Play Framework 2.6.0 through 2.8.2, stack consumption can…7.5
• CVE-2020-26884RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL inject…6.1
• CVE-2020-26886Softaculous before 5.5.7 is affected by a code execution vul…7.8
• CVE-2020-26887FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of…7.8
• CVE-2020-2689Vulnerability in the Oracle VM VirtualBox product of Oracle …6.5
• CVE-2020-26890Matrix Synapse before 1.20.0 erroneously permits non-standar…7.5
• CVE-2020-26891AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerabl…6.1
• CVE-2020-26892The JWT library in NATS nats-server before 2.1.9 has Incorre…9.8