CVE-2020-5502

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jan 15, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-55048.8In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL inCVE-2020-55059.8Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"applicCVE-2020-55097.2PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.CVE-2020-55109.8PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file.CVE-2020-55118.8PHPGurukul Small CRM v2.0 was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page.CVE-2020-55126.8Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.CVE-2020-55136.8Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.CVE-2020-55149.1Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.CVE-2020-55157.2Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.CVE-2020-55176.5CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis.CVE-2020-55199.8The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > ExtCVE-2020-55207.4The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoo
CVE-2020-5502: Medium severity, CVSS 6.5 | Vulnix