CVE-2020-5659

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Neuroinformatics Unit, Integrative Computational Brain Science Collaboration Division, RIKEN Center for Brain Science	XooNIps	3.49 and earlier

References

https://jvn.jp/en/vu/JVNVU92053563/index.htmlThird Party Advisory
https://xoonips.osdn.jp/modules/news/index.php?page=article&storyid=13Release Notes, Vendor Advisory
https://jvn.jp/en/vu/JVNVU92053563/index.htmlThird Party Advisory
https://xoonips.osdn.jp/modules/news/index.php?page=article&storyid=13Release Notes, Vendor Advisory

Timeline

Published: Nov 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-56625.4Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script vi CVE-2020-56635.4Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via u CVE-2020-56649.8Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecifie CVE-2020-56657.4Improper check or handling of exceptional conditions in MELSEC iQ-F series FX5U(C) CPU unit firmware version 1.060 and earlier allows an att CVE-2020-56667.5Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/CVE-2020-56675.5Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service.CVE-2020-56687.5Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/CVE-2020-56695.4Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier CVE-2020-56747.8Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan ho CVE-2020-56757.5Out-of-bounds read vulnerability in GT21 model of GOT2000 series (GT2107-WTBD V01.39.000 and earlier, GT2107-WTSD V01.39.000 and earlier, GT CVE-2020-56767.5GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors.CVE-2020-56776.1Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified