CVE-2020-27406

MediumCVSS 5.4

Published: 02/11/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.73%

50th percentile - higher than 50% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability was found in DynPG 4.9.1. An authenticated attacker can execute arbitrary JavaScript code via the groupname parameter.

Risk Assessment

An attacker can hijack user sessions, steal sensitive data, or spread malware within the organization.

Recommendation

Immediately update DynPG to the latest version and implement input validation and output encoding for the groupname parameter.

Original NVD description (English source)

Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.