CVE-2020-26680 - CVE House
Back to Database
Status published Medium CVE-2020-26680

In vFairs 3.3, any user logged in to a vFairs...

Vulnerability Description

In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26680

Credits & Attribution

No credits recorded in the NVD database.

References

More from vfairs

View All →
CVE-2020-26679
vFairs 3.3 is affected by Insecure Permissions. Any user logged...
Medium 4.3
CVE-2020-26678
vFairs 3.3 is affected by Remote Code Execution. Any user...
High 8.8
CVE-2020-26677
Any user logged in to a vFairs 3.3 virtual conference...
High 8.8

Affected Vendor

Affected Software

vfairs
Vulnerable Versions:
3.3

Timeline

Official Publish: May 26th, 2021
Last Modified: July 9th, 2026
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.