CVE-2020-11436

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 15, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-114374.3LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database.CVE-2020-114388.8LibreHealth EMR v2.0.0 is affected by systemic CSRF.CVE-2020-114398.8LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR applicaCVE-2020-11447.8An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker wCVE-2020-114407.5httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.CVE-2020-114416.1phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be refleCVE-2020-114438.1The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing CVE-2020-114448.8Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.CVE-2020-114455.3TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involvCVE-2020-114467.8ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET diCVE-2020-114474.3An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req CVE-2020-114486.1An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page.
CVE-2020-11436: Critical severity, CVSS 9.0 | Vulnix