CVE-2020-10227

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript code via the From field of an email.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://sourceforge.net/projects/vtecrm/Product, Third Party Advisory
https://vtenext.com/en/Vendor Advisory
https://www.exploit-db.com/exploits/48804Exploit, Third Party Advisory, VDB Entry
https://sourceforge.net/projects/vtecrm/Product, Third Party Advisory
https://vtenext.com/en/Vendor Advisory
https://www.exploit-db.com/exploits/48804Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Sep 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-102288.8A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote co CVE-2020-102298.8A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, a CVE-2020-10238.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa CVE-2020-102309.8CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php t CVE-2020-102317.5TP-Link NC200 through 2.1.8_Build_171109, NC210 through 1.0.9_Build_171214, NC220 through 1.3.0_Build_180105, NC230 through 1.3.0_Build_1712 CVE-2020-102329.8In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing log CVE-2020-102339.1In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.CVE-2020-102346.5The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL to the device driver.CVE-2020-102358.8An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary co CVE-2020-102366.1An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation direct CVE-2020-102375.5An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, set CVE-2020-102387.5An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potentia