What’s Vulnerable › Vulnerabilities

CVE-2020-13694

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-06-01 · updated 2026-06-17
• Weakness: CWE-78

Description

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option.

Affected products

• Quickbox: through 2.5.5; through 2.1.8

References

• https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/
• https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/

Get alerted when CVE-2020-13694 or the next vulnerability affects your stack