CVE-2020-26680
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.
Risk Assessment
An attacker can steal sessions, credentials, or redirect users to malicious sites, compromising the confidentiality and integrity of event participant data.
Recommendation
Immediately update vFairs to the latest version and implement input filtering and encoding to prevent HTML/JavaScript injection.
Other vulnerabilities in vFairs
See all- CVE-2020-26679Medium
vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.
- CVE-2020-26678High
vFairs 3.3 is affected by Remote Code Execution. Any logged-in user can abuse the profile picture upload functionality to place a malicious PHP file on the server and gain code execution.
- CVE-2020-26677High
SQL injection vulnerability in vFairs 3.3 allows any logged-in user to inject malicious SQL queries into the API. An attacker can manipulate the database of the conference or event.
Original NVD description (English source)
In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS