← Retour aux CVEs

CVE-2020-37148

LOW

3.5

Description

P5 FNIP-8x16A/FNIP-4xSH versions 1.0.20 and 1.0.11 suffer from a stored cross-site scripting vulnerability. Input passed to several GET/POST parameters is not properly sanitized before being returned to the user, allowing attackers to execute arbitrary HTML and script code in a user's browser session in the context of the affected site. This can be exploited by submitting crafted input to the label modification functionality, such as the 'lab4' parameter in config.html.

Details CVE

Score CVSS v3.13.5

SeveriteLOW

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurREQUIRED

Publie2/5/2026

Derniere modification2/5/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-79

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/176993(disclosure@vulncheck.com)

https://packetstormsecurity.com/files/156170/P5-FNIP-8x16A-FNIP-4xSH-1.0.20-CSRF-XSS.html(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/48362(disclosure@vulncheck.com)

https://www.p5.hu/(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/p-fnip-xafnip-xsh-stored-cross-site-scripting-xss(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5564.php(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.