CVE-2020-20296

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Feb 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-202989.8Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackCVE-2020-202997.5WeiPHP 5.0 does not properly restrict access to pages, related to using POST.CVE-2020-20307.2An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS coCVE-2020-203009.8SQL injection vulnerability in the wp_where function in WeiPHP 5.0.CVE-2020-20314.9An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issuCVE-2020-20327.0A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with CVE-2020-20335.3When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logonCVE-2020-203357.5Buffer Overflow vulnerability in Antirez Kilo before commit 7709a04ae8520c5b04d261616098cebf742f5a23 allows a remote attacker to cause a denCVE-2020-20348.1An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitraCVE-2020-203407.5A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database inforCVE-2020-203417.5YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.CVE-2020-203436.5WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attacke