CVE-2020-36125

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacker through requesting the endpoint directly.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/Exploit, Third Party Advisory
https://marketing.paxtechnology.com/about-paxProduct
https://www.whatspos.com/Product
https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/Exploit, Third Party Advisory
https://marketing.paxtechnology.com/about-paxProduct
https://www.whatspos.com/Product

Timeline

Published: May 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-361268.1Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation CVE-2020-361276.5Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature fu CVE-2020-361288.2Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session t CVE-2020-361298.8AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.CVE-2020-36137.8Double free issue in kernel memory mapping due to lack of memory protection mechanism in Snapdragon Compute, Snapdragon Mobile, Snapdragon V CVE-2020-361306.5AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.CVE-2020-361318.8AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.CVE-2020-361338.8AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.CVE-2020-361346.5AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c.CVE-2020-361356.5AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.CVE-2020-361367.5SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_CVE-2020-361387.5An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (Do