CVE-2020-35650

Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgm_code_redeem POST Parameter in user-code-redemption.php, the ulgm_user_first POST Parameter in user-registration-form.php, the ulgm_user_last POST Parameter in user-registration-form.php, the ulgm_user_email POST Parameter in user-registration-form.php, the ulgm_code_registration POST Parameter in user-registration-form.php, the ulgm_terms_conditions POST Parameter in user-registration-form.php, the _ulgm_total_seats POST Parameter in frontend-uo_groups_buy_courses.php, the uncanny_group_signup_user_first POST Parameter in group-registration-form.php, the uncanny_group_signup_user_last POST Parameter in group-registration-form.php, the uncanny_group_signup_user_login POST Parameter in group-registration-form.php, the uncanny_group_signup_user_email POST Parameter in group-registration-form.php, the success-invited GET Parameter in frontend-uo_groups.php, the bulk-errors GET Parameter in frontend-uo_groups.php, or the message GET Parameter in frontend-uo_groups.php.

• CWE-79

• https://gist.github.com/michiiii/81d801f563138abe7da61e2d95342202Third Party Advisory
• https://www.uncannyowl.com/knowledge-base/uncanny-learndash-groups-changelog/Release Notes, Vendor Advisory
• https://gist.github.com/michiiii/81d801f563138abe7da61e2d95342202Third Party Advisory
• https://www.uncannyowl.com/knowledge-base/uncanny-learndash-groups-changelog/Release Notes, Vendor Advisory

Published

Dec 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35633A code execution vulnerability exists in the Nef polygon-par…8.8
• CVE-2020-35634A code execution vulnerability exists in the Nef polygon-par…8.8
• CVE-2020-35635A code execution vulnerability exists in the Nef polygon-par…8.8
• CVE-2020-35636A code execution vulnerability exists in the Nef polygon-par…9.8
• CVE-2020-3564A vulnerability in the FTP inspection engine of Cisco Adapti…5.3
• CVE-2020-3565A vulnerability in the TCP Intercept functionality of Cisco …5.8
• CVE-2020-35652An issue was discovered in res_pjsip_diversion.c in Sangoma …6.5
• CVE-2020-35653In Pillow before 8.1.0, PcxDecode has a buffer over-read whe…7.1
• CVE-2020-35654In Pillow before 8.1.0, TiffDecode has a heap-based buffer o…8.8
• CVE-2020-35655In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer ove…5.4
• CVE-2020-35656Jaws through 1.8.0 allows remote authenticated administrator…7.2
• CVE-2020-35657Jaws through 1.8.0 allows remote authenticated administrator…7.2