CVE-2020-20094

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/166448/RTLO-Injection-URI-Spoofing.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/zadewg/RIUSExploit, Third Party Advisory
http://packetstormsecurity.com/files/166448/RTLO-Injection-URI-Spoofing.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/zadewg/RIUSExploit, Third Party Advisory

Timeline

Published: Mar 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-200956.5iMessage (Messages app) iOS 12.4 and prior user interface does not properly represent URI messages to the user, which results in URI spoofin CVE-2020-200966.5Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which res CVE-2020-20107.2An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands CVE-2020-20117.5An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthentic CVE-2020-201185.5Buffer Overflow vulnerability in Avast AntiVirus before v.19.7 allows a local attacker to cause a denial of service via a crafted request to CVE-2020-20127.5Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote CVE-2020-201209.8ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" CVE-2020-201229.8Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.CVE-2020-201248.8Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.CVE-2020-201256.1EARCLINK ESPCMS-P8 contains a cross-site scripting (XSS) vulnerability in espcms_web\espcms_load.php.CVE-2020-201287.5LaraCMS v1.0.1 transmits sensitive information in cleartext which can be intercepted by attackers.CVE-2020-201295.4LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML vi