CVE-2020-36692

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a malicious form that must be manually submitted by the victim while logged in to SWA.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
SophosSophos Web Appliance>= unspecified, < 4.3.10.4

References

Timeline

Published
Apr 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-366946.7An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, becausCVE-2020-366957.8Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage ManCVE-2020-366967.5The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on theCVE-2020-366976.5The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2CVE-2020-366988.8The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and includinCVE-2020-366994.3The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quCVE-2020-36709.1u'Potential out of bounds read while processing downlink NAS transport message due to improper length check of Information Element(IEI) NAS CVE-2020-367008.8The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is dCVE-2020-367018.8The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the CVE-2020-367024.3The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14CVE-2020-367035.4The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, andCVE-2020-367045.4The Fruitful Theme for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters stored via the fruitful_theme_options_a
CVE-2020-36692: Medium severity, CVSS 5.4 | Vulnix