CVE-2020-13756

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jun/7Exploit, Mailing List, Third Party Advisory
https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4Patch, Third Party Advisory
https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1Release Notes, Third Party Advisory
http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jun/7Exploit, Mailing List, Third Party Advisory
https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4Patch, Third Party Advisory
https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00013.html

Timeline

Published: Jun 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-137577.5Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.CVE-2020-137586.1modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by CVE-2020-137597.5rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_ob CVE-2020-13767.8<p>An elevation of privilege vulnerability exists in the way that fdSSDP.dll handles objects in memory. An attacker who successfully exploit CVE-2020-137608.8In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.CVE-2020-137616.1In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modul CVE-2020-137626.1In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.CVE-2020-137637.5In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.CVE-2020-137647.5common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special ca CVE-2020-137655.6rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to tri CVE-2020-137675.9The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insuffi CVE-2020-137689.8In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary cod