CVE-2020-35853

4images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL. This vulnerability can result in an attacker to inject the XSS payload into the IMAGE URL. Each time a user visits that URL, the XSS triggers and the attacker can be able to steal the cookie according to the crafted payload.

• CWE-79

• https://www.exploit-db.com/exploits/49339Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/49339Exploit, Third Party Advisory, VDB Entry

Published

Jan 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35848Agentejo Cockpit before 0.11.2 allows NoSQL injection via th…9.8
• CVE-2020-35849An issue was discovered in MantisBT before 2.24.4. An incorr…7.5
• CVE-2020-3585A vulnerability in the TLS handler of Cisco Adaptive Securit…3.7
• CVE-2020-35850An SSRF issue was discovered in cockpit-project.org Cockpit …6.5
• CVE-2020-35851HGiga MailSherlock does not validate specific parameters pro…9.8
• CVE-2020-35852Chatbox is affected by cross-site scripting (XSS). An attack…6.1
• CVE-2020-35854Textpattern 4.8.4 is affected by cross-site scripting (XSS) …4.8
• CVE-2020-35856SolarWinds Orion Platform before 2020.2.5 allows stored XSS …4.8
• CVE-2020-35857An issue was discovered in the trust-dns-server crate before…7.5
• CVE-2020-35858An issue was discovered in the prost crate before 0.6.1 for …9.8
• CVE-2020-35859An issue was discovered in the lucet-runtime-internals crate…9.1
• CVE-2020-3586A vulnerability in the web-based management interface of Cis…9.8