CVE-2020-8825

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-88267.5As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever CVE-2020-88277.5As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce meaCVE-2020-88288.8As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue cCVE-2020-88298.8CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis.CVE-2020-88308.8CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCACVE-2020-88315.5Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory doeCVE-2020-88325.5The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context swiCVE-2020-88334.7Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalationCVE-2020-88346.5KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{saCVE-2020-88357.8In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operaCVE-2020-88386.4An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and CVE-2020-88396.1Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
CVE-2020-8825: Medium severity, CVSS 5.4 | Vulnix