vFairs 3.3
Approved changes feed: RSS · Atom
cpe:2.3:a:vfairs:vfairs:3.3:*:*:*:*:*:*:*part: a version: 3.3 update: *
| Vendor | Vfairs (72a8a91d-a117-5afa-b533-ae551a8ee454) |
|---|---|
| Product | Vfairs (1a6a2711-5f47-59ee-9a64-1b9fd3e89181) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-26680 |
vulnerable | 2026-06-08 05:23:51.436219 |
Details available
In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.
Published: 2021-05-26T11:54:59.000Z
Updated: 2026-07-09T00:11:30.389Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-26679 |
vulnerable | 2026-06-08 05:23:51.435910 |
Details available
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profile description or supply a new profile image. This can lead to potential cross-site scripting attacks on any user, or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room.
Published: 2021-05-26T11:53:14.000Z
Updated: 2026-07-09T00:11:29.145Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-26678 |
vulnerable | 2026-06-08 05:23:51.435355 |
Details available
vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse the functionality to upload a profile picture in order to place a malicious PHP file on the server and gain code execution.
Published: 2021-05-26T11:50:40.000Z
Updated: 2026-07-09T00:11:27.903Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-26677 |
vulnerable | 2026-06-08 05:23:51.434825 |
Details available
Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API.
Published: 2021-05-26T11:58:21.000Z
Updated: 2026-07-09T00:11:26.653Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.