CVE-2020-10409

This flaw can make an administrator page display attacker-supplied content when someone follows a specially made link. It is like slipping a convincing fake instruction into a manager's clipboard: the page may look normal, but it can try to make the manager's browser perform unwanted actions.

This matters to you if you run PHPKB Standard Multi-Language 9 and use its administrator area. An attacker needs an administrator-level login and must persuade an administrator to open a crafted link.

An attacker would need privileged access and an administrator to open a malicious link, so this is an amber-priority issue rather than an emergency. There is no record of active exploitation or public exploit code, but protect administrator access and seek a vendor remedy promptly.

Confirm the installed PHPKB edition and version, then verify whether the administrator interface, including admin/edit-template.php, is available to staff. The reported affected release is PHPKB Standard Multi-Language 9; no fixed release or supported upgrade path is documented in the available findings. If patching is delayed, limit admin access to trusted users and networks, avoid untrusted links to the admin interface, and review administrator activity and template changes for unexpected actions. CISA has not added this CVE to KEV, so no CISA remediation due date applies.

CVE-2020-10409 is rated CVSS 4.8 (Medium): CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. It is CWE-79 reflected XSS in URI handling in admin/header.php, triggered through a crafted query string when accessing admin/edit-template.php. No CISA KEV listing, active-exploitation report, or public exploit code is recorded. EPSS predicts a 0.6% likelihood and the trend is flat; exploit maturity is not established.