CVE Vulnerability

CWE-79

CVE-2020-26166

by

The file upload functionality in qdPM 9.1 doesn’t check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.

CVE-2020-26110

by

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).

CVE-2020-26111

by

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).

CVE-2020-26113

by

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).

CVE-2020-26114

by

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).

CVE-2020-26115

by

cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).