CVE-2020-26574

9.6 criticalEPSS 2.1%

Critical (9.6) in leostream connection broker. EPSS 2.1% chance of exploitation in the next 30 days.

Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a malicious Perl script that will be executed as root via libMisc::browser_client. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2020-10-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

leostream:connection_broker

References

https://adepts.of0x.cc/leostream-xss-to-rce/
https://www.leostream.com/resources/product-lifecycle/
https://adepts.of0x.cc/leostream-xss-to-rce/
https://www.leostream.com/resources/product-lifecycle/

Check your stack JSON