CVE-2020-20640

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.jianshu.com/p/219755c047a1Exploit, Third Party Advisory
https://www.jianshu.com/p/219755c047a1Exploit, Third Party Advisory

Timeline

Published: Jun 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-206428.8Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admi CVE-2020-206455.4Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.CVE-2020-206577.5Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denial of service via an unexpected packet while CVE-2020-206587.5Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denail of service when trying to calloc an unexp CVE-2020-206626.5libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c.CVE-2020-206636.5libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c.CVE-2020-206646.5libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c.CVE-2020-206657.5rudp v0.6 was discovered to contain a memory leak in the component main.c.CVE-2020-206708.8An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTM CVE-2020-206718.8A cross-site request forgery (CSRF) in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account.CVE-2020-206727.8An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a crafted PHP file.CVE-2020-206759.8Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/.