CVE-2020-29574

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Aug 15, 2026

Description

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 11, 2020
Last modified
Aug 15, 2026
Added to CISA KEV
Feb 6, 2025
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-295759.8The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir LCVE-2020-295769.8The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deplCVE-2020-295779.8The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed bCVE-2020-295789.8The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik DockeCVE-2020-295799.8The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker CVE-2020-29587.5Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PriorCVE-2020-295809.8The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed byCVE-2020-295819.8The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deplCVE-2020-295825.3In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data CVE-2020-295839.8Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this accCVE-2020-295875.4SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.jCVE-2020-29598.6Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior