CVE-2020-25715

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-257168.1A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attack CVE-2020-257178.1A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privileg CVE-2020-257188.8A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This CVE-2020-257197.2A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC CVE-2020-25722.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plugin). Supported versions that are affected are 5.7.28 CVE-2020-257207.5A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all at CVE-2020-257218.8Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to CVE-2020-257228.8Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw CVE-2020-257233.2A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing ha CVE-2020-257244.3A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to pri CVE-2020-257255.5In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which CVE-2020-257277.5The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within