CVE-2020-1961

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
May 4, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-196116.1Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via thCVE-2020-196137.5Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version 20190503.CVE-2020-196165.4Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.CVE-2020-196175.4Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.CVE-2020-196185.4Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.CVE-2020-196195.4Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.CVE-2020-196259.8Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitCVE-2020-196265.4Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settCVE-2020-19639.1Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to accesCVE-2020-196398.8Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI.CVE-2020-19649.8It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML pCVE-2020-196407.5An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causin
CVE-2020-1961: Critical severity, CVSS 9.8 | Vulnix