CVE-2020-10235

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-102366.1An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation direct CVE-2020-102375.5An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, set CVE-2020-102387.5An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potentia CVE-2020-102398.8An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadm CVE-2020-10248.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa CVE-2020-102405.3An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate u CVE-2020-102418.8An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.CVE-2020-102426.1An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS atta CVE-2020-102439.8An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnera CVE-2020-102447.5JPaseto before 0.3.0 generates weak hashes when using v2.local tokens.CVE-2020-102459.8CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.CVE-2020-102466.1MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.