CVE-2020-8160

MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.

• CWE-79
• CWE-79

• https://hackerone.com/reports/838178Third Party Advisory
• https://marketplace.mendix.com/link/component/111349Product, Vendor Advisory
• https://hackerone.com/reports/838178Third Party Advisory
• https://marketplace.mendix.com/link/component/111349Product, Vendor Advisory

Published

Jan 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8154An Insecure direct object reference vulnerability in Nextclo…7.7
• CVE-2020-8155An outdated 3rd party library in the Files PDF viewer for Ne…5.4
• CVE-2020-8156A missing verification of the TLS host in Nextcloud Mail 1.1…7
• CVE-2020-8157UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and C…6.8
• CVE-2020-8158Prototype pollution vulnerability in the TypeORM package < 0…9.8
• CVE-2020-8159There is a vulnerability in actionpack_page-caching gem < v1…9.8
• CVE-2020-8161A directory traversal vulnerability exists in rack < 2.2.0 t…8.6
• CVE-2020-8162A client side enforcement of server side security vulnerabil…7.5
• CVE-2020-8163The is a code injection vulnerability in versions of Rails p…8.8
• CVE-2020-8164A deserialization of untrusted data vulnerability exists in …7.5
• CVE-2020-8165A deserialization of untrusted data vulnernerability exists …9.8
• CVE-2020-8166A CSRF forgery vulnerability exists in rails < 5.2.5, rails …4.3