Total
415241 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-28848 | 1 Churchcrm | 1 Churchcrm | 2026-06-17 | N/A | 8.8 HIGH |
| CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file. | |||||
| CVE-2020-28847 | 1 Valine.js | 1 Valine | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. | |||||
| CVE-2020-28846 | 1 Seacms | 1 Seacms | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin account. | |||||
| CVE-2020-28845 | 1 Netskope | 1 Netskope | 2026-06-17 | 9.3 HIGH | 7.8 HIGH |
| A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system. | |||||
| CVE-2020-28841 | 1 Drivergenius | 1 Drivergenius Firmware | 2026-06-17 | 7.1 HIGH | 5.5 MEDIUM |
| MyDrivers64.sys in DriverGenius 9.61.3708.3054 allows attackers to cause a system crash via the ioctl command 0x9c402000 to \\.\MyDrivers0_0_1. | |||||
| CVE-2020-28840 | 1 Matthiaswandel | 1 Jhead | 2026-06-17 | N/A | 7.8 HIGH |
| Buffer Overflow vulnerability in jpgfile.c in Matthias-Wandel jhead version 3.04, allows local attackers to execute arbitrary code and cause a denial of service (DoS). | |||||
| CVE-2020-28838 | 1 Opencart | 1 Opencart | 2026-06-17 | 3.5 LOW | 3.5 LOW |
| Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart. | |||||
| CVE-2020-28759 | 1 Tengine Project | 1 Tengine | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| The serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash. NOTE: another person has stated "I don't think there is an proof of overflow so far. | |||||
| CVE-2020-28736 | 1 Plone | 1 Plone | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role). | |||||
| CVE-2020-28735 | 1 Plone | 1 Plone | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). | |||||
| CVE-2020-28734 | 1 Plone | 1 Plone | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. | |||||
| CVE-2020-28726 | 1 Seeddms | 1 Seeddms | 2026-06-17 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php. | |||||
| CVE-2020-28724 | 1 Palletsprojects | 1 Werkzeug | 2026-06-17 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. | |||||
| CVE-2020-28723 | 1 Cloudavid | 1 Pparam | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Memory leak in IPv6Param::setAddress in CloudAvid PParam 1.3.1. | |||||
| CVE-2020-28722 | 1 Deskpro | 1 Deskpro | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vulnerability that can lead to an account takeover via custom email templates. | |||||
| CVE-2020-28717 | 1 Kindsoft | 1 Kindeditor | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in content1 parameter in demo.jsp in kindsoft kindeditor version 4.1.12, allows attackers to execute arbitrary code. | |||||
| CVE-2020-28713 | 1 Nightowlsp | 2 Smart Doorbell, Smart Doorbell Firmware | 2026-06-17 | 5.8 MEDIUM | 6.5 MEDIUM |
| Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via an exposed PNS server. A remote attacker can passively record push notification events which are sent over an insecure web request. The web service does not authenticate requests, and allows attackers to send an indefinite amount of motion or doorbell events to a user's mobile application by either replaying or deliberately crafting false events. | |||||
| CVE-2020-28705 | 1 Thedaylightstudio | 1 Fuel Cms | 2026-06-17 | 4.3 MEDIUM | 4.3 MEDIUM |
| FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3. | |||||
| CVE-2020-28702 | 1 Pybbs Project | 1 Pybbs | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information. | |||||
| CVE-2020-28695 | 1 Askey | 2 Rtf3505vw-n1 Br Sv G000 R3505vwn1001 S32 7, Rtf3505vw-n1 Br Sv G000 R3505vwn1001 S32 7 Firmware | 2026-06-17 | 8.3 HIGH | 8.8 HIGH |
| Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root. | |||||