CVE-2020-14487

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-912

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-144888.8OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitCVE-2020-144897.5OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords usCVE-2020-14497.8A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, akaCVE-2020-144908.8OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow diCVE-2020-144916.5OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege CVE-2020-144926.1OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code witCVE-2020-144938.8A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execuCVE-2020-144949.8OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexitCVE-2020-144969.8Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various vCVE-2020-144979.8Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-contrCVE-2020-1449810.0HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker CVE-2020-144997.5Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may all
CVE-2020-14487: Critical severity, CVSS 9.8 | Vulnix