CVE-2020-25116

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 3, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-251174.8The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.CVE-2020-251184.8The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.CVE-2020-251194.8The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.CVE-2020-25125.9Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.CVE-2020-251204.8The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.CVE-2020-251214.8The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.CVE-2020-251224.8The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.CVE-2020-251234.8The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.CVE-2020-251244.8The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.CVE-2020-251257.8GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim iCVE-2020-25135.4Vulnerability in the Oracle Application Express component of Oracle Database Server. Supported versions that are affected are 5.1-19.2. EasiCVE-2020-251306.5An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that
CVE-2020-25116: Medium severity, CVSS 4.8 | Vulnix