2020 CVEs (page 2)
Page 2 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37163 | High | 8.2 | 2026-02-07 | QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the '_located' parameter in the find… |
CVE-2020-37162 | Critical | 9.8 | 2026-02-07 | Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitrary code by overwri… |
CVE-2020-37161 | Critical | 9.8 | 2026-02-07 | Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name fie… |
CVE-2020-37160 | Medium | 6.2 | 2026-02-07 | SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local… |
CVE-2020-37159 | Critical | 9.8 | 2026-02-07 | Parallaxis Cuckoo Clock 5.0 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory registers in the ala… |
CVE-2020-37157 | High | 7.5 | 2026-02-07 | DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unp… |
CVE-2020-37155 | High | 7.5 | 2026-02-07 | Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized in… |
CVE-2020-37154 | High | 7.1 | 2026-02-07 | eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries th… |
CVE-2020-37147 | High | 7.1 | 2026-02-07 | ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through… |
CVE-2020-37146 | High | 7.5 | 2026-02-07 | ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration fi… |
CVE-2020-37141 | High | 8.2 | 2026-02-07 | AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module's maildetail.php script through the 'id' parameter. Attackers can manipulate the… |
CVE-2020-37135 | High | 7.5 | 2026-02-07 | AMSS++ 4.7 contains an authentication bypass vulnerability that allows attackers to access administrative accounts using hardcoded credentials. Attackers can l… |
CVE-2020-37122 | High | 7.5 | 2026-02-07 | SpotFTP-FTP Password Recover 2.4.8 contains a denial of service vulnerability that allows attackers to crash the application by generating a large buffer overf… |
CVE-2020-37109 | High | 7.5 | 2026-02-07 | aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Subject title field with… |
CVE-2020-37107 | High | 7.5 | 2026-02-07 | Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field with a large buffer… |
CVE-2020-37106 | Medium | 5.3 | 2026-02-07 | Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication… |
CVE-2020-37095 | Critical | 9.8 | 2026-02-07 | Cyberoam Authentication Client 2.1.2.7 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structure… |
CVE-2020-37079 | Medium | 4.3 | 2026-02-07 | Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to… |
CVE-2020-37152 | Medium | 6.1 | 2026-02-05 | PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize us… |
CVE-2020-37150 | High | 7.5 | 2026-02-05 | Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and secur… |
CVE-2020-37149 | High | 8.1 | 2026-02-05 | Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery (CSRF) that can lead to command execution. An attacker can trick an authenticated us… |
CVE-2020-37148 | Low | 3.5 | 2026-02-05 | P5 FNIP-8x16A/FNIP-4xSH versions 1.0.20 and 1.0.11 suffer from a stored cross-site scripting vulnerability. Input passed to several GET/POST parameters is not… |
CVE-2020-37145 | Medium | 4.3 | 2026-02-05 | HRSALE 1.1.8 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized administrative users through the employee registrati… |
CVE-2020-37144 | Medium | 5.3 | 2026-02-05 | Exagate SYSGuard 6001 contains a cross-site request forgery vulnerability that allows attackers to create unauthorized admin accounts through a crafted HTML fo… |
CVE-2020-37143 | High | 7.5 | 2026-02-05 | ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input fie… |
CVE-2020-37142 | High | 8.4 | 2026-02-05 | 10-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code… |
CVE-2020-37140 | Medium | 5.5 | 2026-02-05 | Everest, later referred to as AIDA64, 5.50.2100 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating… |
CVE-2020-37139 | High | 8.4 | 2026-02-05 | Odin Secure FTP Expert 7.6.3 contains a local denial of service vulnerability that allows attackers to crash the application by manipulating site information f… |
CVE-2020-37138 | Critical | 9.8 | 2026-02-05 | 10-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arb… |
CVE-2020-37137 | Medium | 6.1 | 2026-02-05 | PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an… |
CVE-2020-37136 | High | 7.5 | 2026-02-05 | ZOC Terminal 7.25.5 contains a denial of service vulnerability in the private key file input field that allows attackers to crash the application. Attackers ca… |
CVE-2020-37134 | High | 7.5 | 2026-02-05 | UltraVNC Viewer 1.2.4.0 contains a denial of service vulnerability that allows attackers to crash the application by manipulating VNC Server input. Attackers c… |
CVE-2020-37133 | High | 7.5 | 2026-02-05 | UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allows attackers to crash the application. A… |
CVE-2020-37132 | Medium | 6.2 | 2026-02-05 | UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allows local attackers to crash the applicat… |
CVE-2020-37131 | Medium | 6.2 | 2026-02-05 | Nsauditor Product Key Explorer 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially… |
CVE-2020-37130 | High | 7.5 | 2026-02-05 | Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can… |
CVE-2020-37129 | Critical | 9.8 | 2026-02-05 | Memu Play 7.1.3 contains an insecure folder permissions vulnerability that allows low-privileged users to modify the MemuService.exe executable. Attackers can… |
CVE-2020-37128 | Medium | 6.2 | 2026-02-05 | ZOC Terminal 7.25.5 contains a script processing vulnerability that allows local attackers to crash the application by loading a maliciously crafted REXX scrip… |
CVE-2020-37127 | Medium | 5.5 | 2026-02-05 | Dnsmasq-utils 2.79-1 contains a buffer overflow vulnerability in the dhcp_release utility that allows attackers to cause a denial of service by supplying exces… |
CVE-2020-37126 | Critical | 9.8 | 2026-02-05 | Free Desktop Clock 3.0 contains a stack overflow vulnerability in the Time Zones display name input that allows attackers to overwrite Structured Exception Han… |
CVE-2020-37125 | Critical | 9.8 | 2026-02-05 | Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /… |
CVE-2020-37124 | Critical | 9.8 | 2026-02-05 | B64dec 1.1.2 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) with cr… |
CVE-2020-37123 | Critical | 9.8 | 2026-02-05 | Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can… |
CVE-2020-37121 | Medium | 5.5 | 2026-02-05 | CODE::BLOCKS 16.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler with cr… |
CVE-2020-37120 | Critical | 9.8 | 2026-02-05 | Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception Han… |
CVE-2020-37119 | Critical | 9.8 | 2026-02-05 | Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code by overwriting mem… |
CVE-2020-37118 | Low | 3.5 | 2026-02-05 | P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interac… |
CVE-2020-37117 | High | 8.8 | 2026-02-05 | jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files… |
CVE-2020-37151 | High | 8.2 | 2026-02-05 | phpMyChat Plus 1.98 contains a SQL injection vulnerability in the deluser.php page through the pmc_username parameter that allows attackers to manipulate datab… |
CVE-2020-37087 | | 2026-02-03 | Easy Transfer Wifi Transfer v1.7 for iOS contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts by m… | |
CVE-2020-37084 | High | 7.2 | 2026-02-03 | School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as profile photos by bypa… |
CVE-2020-37097 | High | 7.5 | 2026-02-03 | Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file. Att… |
CVE-2020-37096 | Medium | 5.3 | 2026-02-03 | Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface. Attackers can craft malicious web page… |
CVE-2020-37094 | High | 8.1 | 2026-02-03 | EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by ex… |
CVE-2020-37093 | High | 7.5 | 2026-02-03 | Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve WiFi passwords through the netcore_get.c… |
CVE-2020-37092 | High | 7.5 | 2026-02-03 | Netis E1+ version 1.2.32533 contains a hardcoded root account vulnerability that allows unauthenticated attackers to access the device with predefined credenti… |
CVE-2020-37091 | Medium | 5.3 | 2026-02-03 | Maian Support Helpdesk 4.3 contains a cross-site request forgery vulnerability that allows attackers to create administrative accounts without authentication… |
CVE-2020-37090 | Critical | 9.8 | 2026-02-03 | School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malici… |
CVE-2020-37089 | High | 8.2 | 2026-02-03 | School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET req… |
CVE-2020-37088 | High | 7.5 | 2026-02-03 | School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parame… |
CVE-2020-37086 | Medium | 6.2 | 2026-02-03 | Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to access unauthorized file system paths wit… |
CVE-2020-37085 | High | 7.5 | 2026-02-03 | VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through t… |
CVE-2020-37083 | High | 8.2 | 2026-02-03 | PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' pa… |
CVE-2020-37082 | Critical | 9.8 | 2026-02-03 | webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Atta… |
CVE-2020-37081 | High | 7.1 | 2026-02-03 | Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject m… |
CVE-2020-37080 | Critical | 9.8 | 2026-02-03 | webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php administration component that allows authenticated attackers to delete arbitrar… |
CVE-2020-37078 | High | 8.8 | 2026-02-03 | i-doit Open Source CMDB 1.14.1 contains a file deletion vulnerability in the import module that allows authenticated attackers to delete arbitrary files by man… |
CVE-2020-37077 | Medium | 6.5 | 2026-02-03 | Booked Scheduler 2.7.7 contains a directory traversal vulnerability in the manage_email_templates.php script that allows authenticated administrators to access… |
CVE-2020-37076 | High | 8.2 | 2026-02-03 | Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries… |
CVE-2020-37075 | Critical | 9.8 | 2026-02-03 | LanSend 3.2 contains a buffer overflow vulnerability in the Add Computers Wizard file import functionality that allows remote attackers to execute arbitrary co… |
CVE-2020-37074 | Critical | 9.8 | 2026-02-03 | Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code during the Add Computers Wizard file im… |
CVE-2020-37073 | High | 8.8 | 2026-02-03 | Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user_image… |
CVE-2020-37072 | High | 7.2 | 2026-02-03 | Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts. A… |
CVE-2020-37071 | Critical | 9.8 | 2026-02-03 | CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted pa… |
CVE-2020-37070 | Critical | 9.8 | 2026-02-03 | CloudMe 1.11.2 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code through crafted network packets. Attackers can e… |
CVE-2020-37069 | Critical | 9.8 | 2026-02-03 | Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the NLST command that allows attackers to overwrite system registers. Attackers can… |
CVE-2020-37068 | Critical | 9.8 | 2026-02-03 | Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the LIST command that allows attackers to overwrite system registers. Attackers can… |
CVE-2020-37067 | Critical | 9.8 | 2026-02-03 | Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers to crash the service. Attackers can send… |
CVE-2020-37066 | Critical | 9.8 | 2026-02-03 | GoldWave 5.70 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting malicious input in the File Open URL dialog… |
CVE-2020-37065 | Critical | 9.8 | 2026-02-03 | StreamRipper32 version 2.6 contains a buffer overflow vulnerability in the Station/Song Section that allows attackers to overwrite memory by manipulating the S… |
CVE-2020-37116 | High | 8.8 | 2026-02-03 | GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmi… |
CVE-2020-37115 | Medium | 6.5 | 2026-02-03 | GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption… |
CVE-2020-37114 | Medium | 4.3 | 2026-02-03 | GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and o… |
CVE-2020-37113 | High | 8.8 | 2026-02-03 | GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attac… |
CVE-2020-37112 | High | 7.1 | 2026-02-03 | GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated pa… |
CVE-2020-37111 | Medium | 6.1 | 2026-02-03 | 60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Atta… |
CVE-2020-37110 | High | 8.2 | 2026-02-03 | 60CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queries through unvalidate… |
CVE-2020-37108 | High | 7.1 | 2026-02-03 | PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to manipulate database… |
CVE-2020-37105 | High | 7.1 | 2026-02-03 | PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands thro… |
CVE-2020-37103 | Medium | 6.4 | 2026-02-03 | DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through… |
CVE-2020-37102 | High | 7.8 | 2026-02-03 | Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to potentially execute arb… |
CVE-2020-37101 | High | 7.8 | 2026-02-03 | VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path. Att… |
CVE-2020-37100 | High | 7.8 | 2026-02-03 | Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privi… |
CVE-2020-37099 | High | 7.8 | 2026-02-03 | Disk Savvy Enterprise 12.3.18 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execute a… |
CVE-2020-37098 | High | 7.8 | 2026-02-03 | Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privi… |
CVE-2020-37064 | High | 7.8 | 2026-02-01 | EPSON EasyMP Network Projection 2.81 contains an unquoted service path vulnerability in the EMP_NSWLSV service that allows local users to potentially execute a… |
CVE-2020-37063 | High | 7.8 | 2026-02-01 | TFTP Turbo 4.6.1273 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges… |
CVE-2020-37062 | High | 7.8 | 2026-02-01 | DHCP Turbo 4.61298 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by exploiting the service… |
CVE-2020-37061 | High | 7.8 | 2026-02-01 | BOOTP Turbo 2.0.1214 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system pri… |
CVE-2020-37055 | High | 7.8 | 2026-02-01 | SpyHunter 4 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Atta… |