CVE-2020-28447

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Jul 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-284489.8This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of aCVE-2020-284498.6This affects all versions of package decal. The vulnerability is in the set function.CVE-2020-28458.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions thaCVE-2020-284508.6This affects all versions of package decal. The vulnerability is in the extend function.CVE-2020-284519.8This affects the package image-tiler before 2.0.2.CVE-2020-284528.8This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akkaCVE-2020-284539.8This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.CVE-2020-284556.1This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.CVE-2020-284566.1The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel.CVE-2020-284574.8This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderConCVE-2020-284587.3All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATCVE-2020-284596.1This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.