CVE WatchAug 11, 2026

CVE-2020-3580

Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability

CVSS

6.1

Medium

EPSS

85.6%

p100

KEV

YES

Nov 3, 2021

Exploit Today

0-100

Published: Oct 21, 2020 · Last modified: Aug 11, 2026 · CWE-79

EPSS · 30d

85.6%EPSS · 30 days85.6%

2026-09-172026-10-15

KEV catalog record

Product

Cisco / Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)

Vulnerability

Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability

Added to KEV

Nov 3, 2021

Remediate by

May 3, 2022

Known ransomware use

Yes

Summary description

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-3580

Technical description

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1112845.4 MED

—

———Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.9h CVE-2026-63430—

—

——0ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia does not correctly implement annotation-xml's encoding-dependent MathML integration-point behavior after attribute filtering removes encoding, so the sanitizer validates a descendant under one namespace interpretation while the browser reparses the output under another. An attacker can use that namespace transition and an allowed raw-text HTML element to execute JavaScript when a user renders the sanitized output. The required tags are not enabled by default, so applications that do not explicitly allow them are not affected. This issue is fixed in versions 3.3.2, 4.0.2, and 4.1.3.10h CVE-2026-558728.7 HIG

—

——0GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.12h CVE-2026-1112334.7 MED

—

——0Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.10h CVE-2026-1112324.8 MED

—

——0Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.10h CVE-2026-1111685.4 MED

—

——0LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.11h