Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-10446: The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/report-category.php by adding a questio...

CVE-2020-10446 · published 6 years ago

Summary

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/report-category.php by adding a question mark (?) followed by the payload.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
chadhaajay	phpkb	9.0 `cpe:2.3:a:chadhaajay:phpkb:9.0:::::::*`

Original advisory text

References

http://antoniocannito.it/?p=137#uxss Exploit Third Party Advisory
https://antoniocannito.it/phpkb1#reflected-cross-site-scripting-in-every-admin-p... Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published12 Mar 2020

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2020-10446 · NVD

Track software like this

Free during beta