CVE-2020-22790

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web script or HTML via modifying the name of the users. The XSS is executed when an administrator access the logs.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-22808.8A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code.CVE-2020-228079.8An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature.CVE-2020-228086.1An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.CVE-2020-228097.8In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.CVE-2020-22815.4A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserv CVE-2020-228189.8MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.CVE-2020-228199.8MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.CVE-2020-22824.3Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read CVE-2020-228209.8MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.CVE-2020-22835.4Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulne CVE-2020-228396.1Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers t CVE-2020-22847.1Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.