CVE-2020-35705

Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.

• CWE-79

• https://github.com/Bottelet/DaybydayCRM/releasesThird Party Advisory
• https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.htmlExploit, Third Party Advisory
• https://github.com/Bottelet/DaybydayCRM/releasesThird Party Advisory
• https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.htmlExploit, Third Party Advisory

Published

Dec 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35693On some Samsung phones and tablets running Android through 7…8.8
• CVE-2020-35698Thinkific Thinkific Online Course Creation Platform 1.0 is a…6.1
• CVE-2020-35700A second-order SQL injection issue in Widgets/TopDevicesCont…8.8
• CVE-2020-35701An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL…8.8
• CVE-2020-35702DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a…7.8
• CVE-2020-35704Daybyday 2.1.0 allows stored XSS via the Title parameter to …5.4
• CVE-2020-35706Daybyday 2.1.0 allows stored XSS via the Title parameter to …5.4
• CVE-2020-35707Daybyday 2.1.0 allows stored XSS via the Company Name parame…5.4
• CVE-2020-35708phpList 3.5.9 allows SQL injection by admins who provide a c…7.2
• CVE-2020-35709bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php fi…4.9
• CVE-2020-3571A vulnerability in the ICMP ingress packet processing of Cis…8.6
• CVE-2020-35710Parallels Remote Application Server (RAS) 18 allows remote a…5.3