CVE-2020-3926

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-39277.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they mCVE-2020-39289.8GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.CVE-2020-39295.9GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack wCVE-2020-39303.3GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.CVE-2020-39319.8Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.CVE-2020-39327.5A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.CVE-2020-39335.3TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user accounCVE-2020-39349.8TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL InjectionCVE-2020-39357.5TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookCVE-2020-39369.8UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can injectCVE-2020-39377.5SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitraryCVE-2020-39387.5SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into ne
CVE-2020-3926: High severity, CVSS 7.5 | Vulnix