CVE-2020-26944

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the main login page (aka cse?cmd=LOGIN). This can be exploited directly, and remotely.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.aptean.comVendor Advisory
https://www.logicallysecure.com/blog/sql-injection-in-aptean/Exploit, Third Party Advisory
https://www.aptean.comVendor Advisory
https://www.logicallysecure.com/blog/sql-injection-in-aptean/Exploit, Third Party Advisory

Timeline

Published: Oct 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-269458.1MyBatis before 3.5.6 mishandles deserialization of object streams.CVE-2020-269477.8monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which a CVE-2020-269489.8Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.CVE-2020-26955.3Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Approval Framework). Suppo CVE-2020-269508.8In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condi CVE-2020-269516.1A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker alre CVE-2020-269528.8Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash wh CVE-2020-269534.3It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phish CVE-2020-269544.3When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed de CVE-2020-269556.5When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download opera CVE-2020-269566.1In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerabili CVE-2020-269576.5OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce