CVE-2020-22809

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 10, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-22815.4A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreservCVE-2020-228189.8MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.CVE-2020-228199.8MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.CVE-2020-22824.3Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read CVE-2020-228209.8MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.CVE-2020-22835.4Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulneCVE-2020-228396.1Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers tCVE-2020-22847.1Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2020-228406.1Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attackerCVE-2020-228414.8Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin nameCVE-2020-228425.4CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.CVE-2020-228447.5A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.
CVE-2020-22809: High severity, CVSS 7.8 | Vulnix