CVE-2020-37007

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Attackers can craft malicious HTML forms to change user passwords or modify account information by tricking logged-in users into submitting unauthorized requests.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
salihciftciLiman0.7

References

Timeline

Published
Jan 29, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-370087.5EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to aCVE-2020-370098.8MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload maliciouCVE-2020-37017.8Use after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon MobiCVE-2020-370109.8BearShare Lite 5.2.5 contains a buffer overflow vulnerability in the Advanced Search keywords input that allows attackers to execute arbitraCVE-2020-370117.5Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malCVE-2020-370129.8Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands throuCVE-2020-370138.4Audio Playback Recorder 3.2.2 contains a local buffer overflow vulnerability in the eject and registration parameters that allows attackers CVE-2020-370146.4Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject maCVE-2020-370157.5The Ruijie Networks Switch eWeb S29_RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to CVE-2020-370167.8BarcodeOCR 19.3.6 contains an unquoted service path vulnerability that allows local attackers to execute code with elevated privileges durinCVE-2020-370177.8CodeMeter 6.60 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated sCVE-2020-370186.4GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through
CVE-2020-37007: Medium severity, CVSS 4.3 | Vulnix