VULNERABILITY INTELLIGENCE

CVE-2020-26680

CVSS score5.4 MEDIUM
EPSS probability0.46%
CISA KEVNot currently listed
Published2021-05-26
Last modified2026-07-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.

Weakness classification

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references