CVE-2020-7356

9.8 criticalEPSS 14%

Critical (9.8) in cayintech xpost. EPSS 14% chance of exploitation in the next 30 days.

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 14% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2020-08-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cayintech:xpost

References

https://github.com/rapid7/metasploit-framework/pull/13607
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php
https://github.com/rapid7/metasploit-framework/pull/13607
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php

Check your stack JSON