2020 CVEs (page 4)
Page 4 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36975 | High | 7.8 | 2026-01-27 | EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by exploit… |
CVE-2020-36974 | High | 7.8 | 2026-01-27 | Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated… |
CVE-2020-36951 | High | 8.2 | 2026-01-27 | Phpscript-sgh 0.1.0 contains a time-based blind SQL injection vulnerability in the admin interface that allows attackers to manipulate database queries through… |
CVE-2020-36950 | Medium | 6.5 | 2026-01-27 | Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. A… |
CVE-2020-36949 | High | 7.5 | 2026-01-27 | TapinRadio 2.13.7 contains a denial of service vulnerability in the application proxy settings that allows attackers to crash the program by overflowing input… |
CVE-2020-36948 | Critical | 9.8 | 2026-01-27 | VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can e… |
CVE-2020-36947 | High | 7.1 | 2026-01-27 | LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database infor… |
CVE-2020-36946 | High | 7.5 | 2026-01-27 | SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an ov… |
CVE-2020-36942 | High | 8.8 | 2026-01-27 | Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Att… |
CVE-2020-36941 | Critical | 9.8 | 2026-01-27 | Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Att… |
CVE-2020-36940 | Critical | 9.8 | 2026-01-27 | Easy CD & DVD Cover Creator 4.13 contains a buffer overflow vulnerability in the serial number input field that allows attackers to crash the application. Atta… |
CVE-2020-36939 | High | 7.5 | 2026-01-27 | Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal p… |
CVE-2020-36938 | High | 8.8 | 2026-01-27 | WinAVR version 20100110 contains an insecure permissions vulnerability that allows authenticated users to modify system files and executables. Attackers can le… |
CVE-2020-36960 | Medium | 6.4 | 2026-01-26 | Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user profile first and last name fiel… |
CVE-2020-36959 | High | 7.8 | 2026-01-26 | IDT PC Audio 1.0.6499.0 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system priv… |
CVE-2020-36958 | High | 7.8 | 2026-01-26 | Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitr… |
CVE-2020-36957 | High | 7.8 | 2026-01-26 | PDF Complete 3.5.310.2002 contains an unquoted service path vulnerability in its pdfsvc.exe service configuration. Attackers can exploit the unquoted path to i… |
CVE-2020-36956 | Medium | 6.4 | 2026-01-26 | Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' p… |
CVE-2020-36955 | Medium | 6.4 | 2026-01-26 | Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scrip… |
CVE-2020-36954 | Medium | 6.4 | 2026-01-26 | Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject m… |
CVE-2020-36953 | High | 7.8 | 2026-01-26 | MiniTool ShadowMaker 3.2 contains an unquoted service path vulnerability in the MTAgentService that allows local attackers to potentially execute arbitrary cod… |
CVE-2020-36952 | High | 7.8 | 2026-01-26 | IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. A… |
CVE-2020-36937 | High | 7.8 | 2026-01-25 | Microvirt MEMU Play 3.7.0 contains an unquoted service path vulnerability in the MEmusvc Windows service that allows local attackers to potentially execute arb… |
CVE-2020-36936 | High | 7.8 | 2026-01-25 | Magic Mouse 2 Utilities 2.20 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path to i… |
CVE-2020-36935 | High | 7.8 | 2026-01-25 | KMSpico 17.1.0.0 contains an unquoted service path vulnerability in the Service KMSELDI configuration that allows local attackers to potentially execute arbitr… |
CVE-2020-36934 | High | 7.8 | 2026-01-25 | Deep Instinct Windows Agent 1.2.24.0 contains an unquoted service path vulnerability in the DeepNetworkService that allows local users to potentially execute c… |
CVE-2020-36933 | High | 7.8 | 2026-01-25 | HTC IPTInstaller 4.0.9 contains an unquoted service path vulnerability in the PassThru Service configuration. Attackers can exploit the unquoted binary path to… |
CVE-2020-36932 | Medium | 6.1 | 2026-01-25 | SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScri… |
CVE-2020-36931 | Medium | 6.4 | 2026-01-25 | Click2Magic 1.1.5 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts in the chat name input. Attackers can… |
CVE-2020-36930 | High | 7.8 | 2026-01-16 | SysGauge Server 7.9.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute arbi… |
CVE-2020-36929 | High | 7.8 | 2026-01-16 | Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to potentially… |
CVE-2020-36928 | High | 7.8 | 2026-01-16 | Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit… |
CVE-2020-36927 | High | 7.8 | 2026-01-16 | DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially ex… |
CVE-2020-36926 | High | 7.5 | 2026-01-16 | SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can… |
CVE-2020-36919 | Medium | 6.1 | 2026-01-13 | WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts throu… |
CVE-2020-36911 | Critical | 9.8 | 2026-01-13 | Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attacke… |
CVE-2020-36875 | | 2026-01-09 | AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin proce… | |
CVE-2020-36925 | Critical | 9.8 | 2026-01-06 | Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authenticat… |
CVE-2020-36924 | Medium | 6.1 | 2026-01-06 | Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the cont… |
CVE-2020-36923 | Critical | 9.8 | 2026-01-06 | Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers… |
CVE-2020-36922 | High | 7.5 | 2026-01-06 | Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details thr… |
CVE-2020-36921 | High | 7.5 | 2026-01-06 | RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive webserver l… |
CVE-2020-36920 | High | 8.8 | 2026-01-06 | iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console… |
CVE-2020-36918 | Medium | 4.3 | 2026-01-06 | iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without requ… |
CVE-2020-36917 | High | 7.5 | 2026-01-06 | iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication crede… |
CVE-2020-36916 | High | 8.8 | 2026-01-06 | TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files. Attackers c… |
CVE-2020-36915 | High | 7.5 | 2026-01-06 | Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet… |
CVE-2020-36914 | High | 7.5 | 2026-01-06 | QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication… |
CVE-2020-36913 | Medium | 5.3 | 2026-01-06 | All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session identifier during the… |
CVE-2020-36912 | Critical | 9.8 | 2026-01-06 | Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the… |
CVE-2020-36910 | High | 8.8 | 2026-01-06 | Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploi… |
CVE-2020-36909 | Medium | 6.5 | 2026-01-06 | SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the e… |
CVE-2020-36908 | Medium | 5.3 | 2026-01-06 | SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions wit… |
CVE-2020-36907 | High | 7.5 | 2026-01-06 | Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Atta… |
CVE-2020-36906 | Medium | 4.3 | 2026-01-06 | P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent… |
CVE-2020-36905 | High | 7.5 | 2026-01-06 | FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-… |
CVE-2020-36904 | High | 7.5 | 2025-12-31 | Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the… |
CVE-2020-36903 | High | 8.4 | 2025-12-31 | Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execut… |
CVE-2020-36891 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions… |
CVE-2020-36890 | High | 7.2 | 2025-12-18 | An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Att… |
CVE-2020-36889 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted o… |
CVE-2020-36902 | Critical | 9.8 | 2025-12-10 | UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[… |
CVE-2020-36901 | High | 8.8 | 2025-12-10 | UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts withou… |
CVE-2020-36900 | High | 8.8 | 2025-12-10 | All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without prop… |
CVE-2020-36899 | High | 7.5 | 2025-12-10 | QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through… |
CVE-2020-36898 | Critical | 9.1 | 2025-12-10 | QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete f… |
CVE-2020-36897 | Critical | 9.8 | 2025-12-10 | QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload mali… |
CVE-2020-36896 | High | 7.5 | 2025-12-10 | QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login info… |
CVE-2020-36895 | High | 7.5 | 2025-12-10 | EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive… |
CVE-2020-36894 | High | 7.5 | 2025-12-10 | Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through… |
CVE-2020-36893 | High | 7.5 | 2025-12-10 | Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside th… |
CVE-2020-36892 | Critical | 9.8 | 2025-12-10 | Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to mod… |
CVE-2020-36888 | Medium | 5.3 | 2025-12-10 | SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts… |
CVE-2020-36887 | High | 7.5 | 2025-12-10 | SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access t… |
CVE-2020-36886 | High | 8.8 | 2025-12-10 | SpinetiX Fusion Digital Signage 3.4.8 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without… |
CVE-2020-36885 | Critical | 9.8 | 2025-12-10 | Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrar… |
CVE-2020-36884 | | 2025-12-10 | BrightSign Digital Signage Diagnostic Web Server 8.2.26 and less contains an unauthenticated server-side request forgery vulnerability in the 'url' GET paramet… | |
CVE-2020-36883 | High | 8.1 | 2025-12-10 | SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and dele… |
CVE-2020-36882 | High | 7.5 | 2025-12-05 | Flexsense DiskBoss 7.7.14 allows unauthenticated attackers to upload arbitrary files via /Command/Search Files/Directory field, leading to a denial of service… |
CVE-2020-36881 | High | 7.8 | 2025-12-05 | Flexsense DiskBoss 7.7.14 contains a local buffer overflow vulnerability in the 'Input Directory' component that allows unauthenticated attackers to execute ar… |
CVE-2020-36880 | High | 7.8 | 2025-12-05 | Flexsense DiskBoss 7.7.14 contains a local buffer overflow vulnerability in the 'Reports and Data Directory' field that allows an attacker to execute arbitrary… |
CVE-2020-36879 | | 2025-12-05 | Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startu… | |
CVE-2020-36878 | | 2025-12-05 | ReQuest Serious Play Media Player 3.0 contains an unauthenticated file disclosure vulnerability when input passed through the 'file' parameter in and script is… | |
CVE-2020-36877 | | 2025-12-05 | ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands… | |
CVE-2020-36876 | | 2025-12-05 | ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers… | |
CVE-2020-36874 | | 2025-11-26 | ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoin… | |
CVE-2020-36873 | | 2025-11-26 | Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backu… | |
CVE-2020-36872 | | 2025-11-26 | BACnet Test Server versions up to and including 1.01 contains a remote denial of service vulnerability in its BACnet/IP BVLC packet handling. The server fails… | |
CVE-2020-36871 | | 2025-11-26 | ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint all… | |
CVE-2020-36870 | | 2025-11-07 | Various Ruijie Gateway EG and NBR models firmware versions 11.1(6)B9P1 < 11.9(4)B12P1 contain a code execution vulnerability in the EWEB management system that… | |
CVE-2020-36869 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrat… |
CVE-2020-36868 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and i… |
CVE-2020-36867 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the P… |
CVE-2020-36866 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.3 are vulnerable to cross-site scripting (XSS) via the Manage Users page of the Admin interface. Insufficient validation or esc… |
CVE-2020-36865 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Ed… |
CVE-2020-36864 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards. Insufficient validation or esca… |
CVE-2020-36863 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not prop… |
CVE-2020-36862 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject scr… |
CVE-2020-36861 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting (XSS) vulnerabilities in the ov… |
CVE-2020-36860 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the ob… |