CVE-2020-26218

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-80

Affected software

Vendor	Product	Versions
puncsky	touchbase.ai	< 2.0

References

https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-r4w5-gw36-4792Third Party Advisory
https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-r4w5-gw36-4792Third Party Advisory

Timeline

Published: Nov 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-262196.1touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to CVE-2020-26226.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions CVE-2020-262203.5toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other u CVE-2020-262216.1touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScri CVE-2020-262228.8Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go.CVE-2020-262236.5Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, a CVE-2020-262247.5In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the fu CVE-2020-262256.1In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a CVE-2020-262268.1In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally d CVE-2020-262276.1TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typ CVE-2020-262287.5TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were s CVE-2020-262293.7TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are s