CVE-2020-15156

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Aug 26, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-151576.1In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container imaCVE-2020-151589.8In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happCVE-2020-151597.6baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as CVE-2020-15167.8An elevation of privilege vulnerability exists when the Windows Work Folders Service improperly handles memory. To exploit this vulnerabilitCVE-2020-151609.8PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition pageCVE-2020-151616.1In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The proCVE-2020-151625.4In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed peopleCVE-2020-151638.2Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadaCVE-2020-1516410.0in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing,CVE-2020-151659.1Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actCVE-2020-151667.5In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP eCVE-2020-151678.6In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause M