CVE-2020-15865

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-64 in the report XML file so that they will be compiled and executed on the server that processes this file. This can be used to fully compromise the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-158669.8mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling.CVE-2020-158677.2The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if acc CVE-2020-158687.5Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.CVE-2020-158695.4Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).CVE-2020-15877.8An elevation of privilege vulnerability exists when the Windows Ancillary Function Driver for WinSock improperly handles memory. To exploit CVE-2020-158706.1Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).CVE-2020-158718.8Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.CVE-2020-158736.5In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_fo CVE-2020-158748.8An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands throug CVE-2020-158755.0An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the Li CVE-2020-158768.8An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the Li CVE-2020-158778.8An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" inste