# CVEs published 2020-06-21

8 CVEs were published on June 21, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-14959](https://cve.now/CVE-2020-14959.md): Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2020-14960](https://cve.now/CVE-2020-14960.md): A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, (no CVSS)
- [CVE-2020-14961](https://cve.now/CVE-2020-14961.md): Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value. (no CVSS, concrete5/concrete5)
- [CVE-2020-14962](https://cve.now/CVE-2020-14962.md): Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2020-14958](https://cve.now/CVE-2020-14958.md): In Gogs 0.11.91, MakeEmailPrimary in models/user\_mail.go lacks a "not the owner of the email" check. (no CVSS, gogs.io/gogs)
- [CVE-2020-14954](https://cve.now/CVE-2020-14954.md): Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. (no CVSS)
- [CVE-2020-14950](https://cve.now/CVE-2020-14950.md): aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action= (no CVSS)
- [CVE-2020-14942](https://cve.now/CVE-2020-14942.md): Tendenci 12.0.10 allows unrestricted deserialization in apps\\helpdesk\\views\\staff.py. (no CVSS, tendenci)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.