CVE-2020-8816

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2020
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 10, 2021
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-88178.1Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata.CVE-2020-88188.1An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback procCVE-2020-88198.1An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback prCVE-2020-88205.4An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload intoCVE-2020-88215.4An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML codCVE-2020-88224.8Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.CVE-2020-88236.1htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.CVE-2020-88245.4Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen.CVE-2020-88255.4index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.CVE-2020-88267.5As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever CVE-2020-88277.5As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce meaCVE-2020-88288.8As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue c
CVE-2020-8816: High severity, CVSS 7.2 | Vulnix