CVE-2020-5540

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a specially crafted URL.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
CyberSolutions Inc.	CyberMail	Ver.6.x and Ver.7.x

References

https://gist.github.com/tonykuo76/d2480727faeb768a97800db3058dceedThird Party Advisory
https://jvn.jp/en/jp/JVN46258789/Third Party Advisory
https://sup.cybersolutions.co.jp/otrs/customer.pl?Action=CustomerFAQZoom%3BItemID=985
https://www.chtsecurity.com/news/fff688e5-8ba2-4da2-be65-732fc6c9ce9dThird Party Advisory
https://gist.github.com/tonykuo76/d2480727faeb768a97800db3058dceedThird Party Advisory
https://jvn.jp/en/jp/JVN46258789/Third Party Advisory
https://sup.cybersolutions.co.jp/otrs/customer.pl?Action=CustomerFAQZoom%3BItemID=985
https://www.chtsecurity.com/news/fff688e5-8ba2-4da2-be65-732fc6c9ce9dThird Party Advisory

Timeline

Published: Aug 25, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-55416.1Open redirect vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to redirect users to arbitrary sites and conduct phishi CVE-2020-55429.8Buffer error vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0 CVE-2020-55439.8TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not proper CVE-2020-55449.8Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware CVE-2020-55459.8TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote a CVE-2020-55468.8Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of CVE-2020-55479.8Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmwa CVE-2020-55487.5Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yam CVE-2020-55498.8Cross-site request forgery (CSRF) vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier and Enterprise Ver. 2.0.1 and earlier allows remot CVE-2020-55508.1Session fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0.1 and earlier allows remote attackers to i CVE-2020-55518.8Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service att CVE-2020-55526.1Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified v