Total
416265 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-36957 | 2026-06-17 | N/A | 7.8 HIGH | ||
| PDF Complete 3.5.310.2002 contains an unquoted service path vulnerability in its pdfsvc.exe service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges. | |||||
| CVE-2020-36956 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing the nodejs configuration page. | |||||
| CVE-2020-36955 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the page title field. Attackers can create a new page with a malicious script in the title, which will be executed when the page is viewed in the admin panel or on the site. | |||||
| CVE-2020-36954 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject malicious scripts. Attackers can insert a payload in the Category Name field to execute arbitrary JavaScript code when the page is loaded. | |||||
| CVE-2020-36953 | 2026-06-17 | N/A | 7.8 HIGH | ||
| MiniTool ShadowMaker 3.2 contains an unquoted service path vulnerability in the MTAgentService that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\MiniTool ShadowMaker\AgentService.exe' to inject malicious executables and escalate privileges. | |||||
| CVE-2020-36952 | 2026-06-17 | N/A | 7.8 HIGH | ||
| IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted service path in the IObit Uninstaller Service to insert malicious code that would execute with SYSTEM-level permissions during service startup. | |||||
| CVE-2020-36951 | 2026-06-17 | N/A | 8.2 HIGH | ||
| Phpscript-sgh 0.1.0 contains a time-based blind SQL injection vulnerability in the admin interface that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit this vulnerability by crafting malicious payloads that trigger time delays, enabling them to extract sensitive database information through conditional sleep techniques. | |||||
| CVE-2020-36950 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server. | |||||
| CVE-2020-36949 | 1 Raimersoft | 1 Tapinradio | 2026-06-17 | N/A | 7.5 HIGH |
| TapinRadio 2.13.7 contains a denial of service vulnerability in the application proxy settings that allows attackers to crash the program by overflowing input fields. Attackers can paste a large buffer of 20,000 characters into the username and address fields to cause the application to become unresponsive and require reinstallation. | |||||
| CVE-2020-36948 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions. | |||||
| CVE-2020-36946 | 1 Flexense | 1 Syncbreeze | 2026-06-17 | N/A | 7.5 HIGH |
| SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an oversized payload in the login request to overwhelm the application and potentially disrupt service availability. | |||||
| CVE-2020-36945 | 2026-06-17 | N/A | 8.2 HIGH | ||
| WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating email credentials. Attackers can inject the payload '<email>' OR '1'='1' in both username and password fields to gain unauthorized access to the user panel. | |||||
| CVE-2020-36944 | 1 Ilias | 1 Ilias | 2026-06-17 | N/A | 4.0 MEDIUM |
| ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to PDF. | |||||
| CVE-2020-36943 | 2026-06-17 | N/A | 7.5 HIGH | ||
| aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting subject title fields with excessive data. Attackers can generate a 10,000-character buffer and paste it into the subject title to trigger application instability and potential crash. | |||||
| CVE-2020-36942 | 1 Victor Cms Project | 1 Victor Cms | 2026-06-17 | N/A | 8.8 HIGH |
| Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Attackers can upload a PHP shell to the /img directory and execute system commands by accessing the uploaded file via web browser. | |||||
| CVE-2020-36941 | 1 Guelfoweb | 1 Knockpy | 2026-06-17 | N/A | 9.8 CRITICAL |
| Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet applications. | |||||
| CVE-2020-36940 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Easy CD & DVD Cover Creator 4.13 contains a buffer overflow vulnerability in the serial number input field that allows attackers to crash the application. Attackers can generate a 6000-byte payload and paste it into the serial number field to trigger an application crash. | |||||
| CVE-2020-36938 | 2026-06-17 | N/A | 8.8 HIGH | ||
| WinAVR version 20100110 contains an insecure permissions vulnerability that allows authenticated users to modify system files and executables. Attackers can leverage the overly permissive access controls to potentially modify critical DLLs and executable files in the WinAVR installation directory. | |||||
| CVE-2020-36937 | 2026-06-17 | N/A | 7.8 HIGH | ||
| Microvirt MEMU Play 3.7.0 contains an unquoted service path vulnerability in the MEmusvc Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with elevated LocalSystem privileges. | |||||
| CVE-2020-36936 | 2026-06-17 | N/A | 7.8 HIGH | ||
| Magic Mouse 2 Utilities 2.20 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path to inject malicious executables and gain elevated system privileges by placing a malicious file in the service path. | |||||