CVE-2020-1756

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
n/aMoodle3.8 to 3.8.1, 3.7 to 3.7.4, 3.6 to 3.6.8, 3.5 to 3.5.10 and earlier unsupported versions

References

Timeline

Published
Aug 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-175639.1Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admiCVE-2020-175649.1Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataActiCVE-2020-17578.1A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unCVE-2020-17585.9A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using tCVE-2020-17596.8A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discoCVE-2020-17606.1A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potenCVE-2020-17616.1A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaCVE-2020-17628.6An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a reCVE-2020-17637.5An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attackerCVE-2020-17648.6A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote atCVE-2020-17655.3An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, ACVE-2020-17666.1Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malic
CVE-2020-1756: High severity, CVSS 7.2 | Vulnix