CVE-2020-19682

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 9, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-196835.4A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.CVE-2020-196929.8Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs_module_read in the CVE-2020-196939.8An issue found in Espruino Espruino 6ea4c0a allows an attacker to execute arbitrrary code via oldFunc parameter of the jswrap_object.c:jswraCVE-2020-196959.8Buffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parameter of the njs/njs_vCVE-2020-196976.1Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted scriptCVE-2020-196986.1Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted scriptCVE-2020-196996.1Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the <ifram> tag inCVE-2020-197036.1A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HCVE-2020-197045.4A stored cross-site scripting (XSS) vulnerability via ResourceController.java in spring-boot-admin as of 20190710 allows attackers to executCVE-2020-197059.8thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.CVE-2020-197096.1Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.CVE-2020-19715.9The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. Op
CVE-2020-19682: High severity, CVSS 8.8 | Vulnix