CVE-2020-10191

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/munkireport/munkireport-php/releasesThird Party Advisory
https://github.com/munkireport/munkireport-php/wiki/20200309-Authenticated-Comment-XSSExploit, Third Party Advisory
https://github.com/munkireport/munkireport-php/releasesThird Party Advisory
https://github.com/munkireport/munkireport-php/wiki/20200309-Authenticated-Comment-XSSExploit, Third Party Advisory

Timeline

Published: Mar 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-101926.1An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_CVE-2020-101937.5ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. This affects ve CVE-2020-101946.5cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This di CVE-2020-101956.3The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege CVE-2020-101966.1An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into exi CVE-2020-101998.8Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).CVE-2020-10208.8A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially CVE-2020-102034.8Sonatype Nexus Repository before 3.21.2 allows XSS.CVE-2020-102047.2Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.CVE-2020-102064.4Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx seri CVE-2020-102079.8Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7 CVE-2020-102089.9Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series an