CVE-2020-1696

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-169607.8Windows Backup Engine Elevation of Privilege Vulnerability CVE-2020-169617.8Windows Backup Engine Elevation of Privilege Vulnerability CVE-2020-169627.8Windows Backup Engine Elevation of Privilege Vulnerability CVE-2020-169637.8Windows Backup Engine Elevation of Privilege Vulnerability CVE-2020-169647.8Windows Backup Engine Elevation of Privilege Vulnerability CVE-2020-169677.8A remote code execution vulnerability exists when the Windows Camera Codec Pack improperly handles objects in memory. An attacker who suc CVE-2020-169687.8A remote code execution vulnerability exists when the Windows Camera Codec Pack improperly handles objects in memory. An attacker who suc CVE-2020-169697.1An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who CVE-2020-16975.4It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not vali CVE-2020-169708.1Azure Sphere Unsigned Code Execution Vulnerability CVE-2020-169717.4Azure SDK for Java Security Feature Bypass Vulnerability CVE-2020-169727.8An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations. To exploit this