CVE-2020-17506

Signals

NVD · CVE-2026-7726 · 6.5 · The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync(NVD · CVE-2026-7693 · 7.2 · The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization oNVD · CVE-2026-7520 · 8.1 · The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` anNVD · CVE-2026-7444 · 8.1 · The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missinCISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 7.5 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-7726 · 6.5 · The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync(NVD · CVE-2026-7693 · 7.2 · The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization oNVD · CVE-2026-7520 · 8.1 · The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` anNVD · CVE-2026-7444 · 8.1 · The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missinCISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 7.5 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07

CVE Database · CVE-2020-17506

CVE-2020-17506

· CRITICALModified

CVSS v3.1

9.8

EPSS

93.97%

Published

Aug 12, 2020

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

Exploit-DBArtica Proxy 4.3.0 - Authentication Bypass NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

Affected Products (1)

articatech · web_proxyvulnerable

References (6)

http://packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.html

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/159267/Artica-Proxy-4.30.000000-Authentication-Bypass-Command-Injection.html

ExploitThird Party AdvisoryVDB Entry

https://blog.max0x4141.com/post/artica_proxy/

ExploitThird Party Advisory

http://packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.html

ExploitThird Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs