How severe is CVE-2020-29072?

CVE-2020-29072 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2020-29072 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-29072?

CVE-2020-29072 affects Liquidfiles. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-29072?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-29072 published?

CVE-2020-29072 was published on 2020-11-25 and last updated on 2026-06-17.

CVE-2020-29072

CVE-2020-29072 is a medium-severity vulnerability in Liquidfiles with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-829.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
CVSS v2: 4.3
EPSS exploit prediction: 1% (49th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-829
Affected product: Liquidfiles
Published: 2020-11-25
Last modified: 2026-06-17

Description

A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js.

Frequently asked questions

What is CVE-2020-29072?: A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js.
How severe is CVE-2020-29072?: CVE-2020-29072 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2020-29072 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-29072?: CVE-2020-29072 affects Liquidfiles. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-29072?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-29072 published?: CVE-2020-29072 was published on 2020-11-25 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:liquidfiles:liquidfiles:*:*:*:*:*:*:*:*

More vulnerabilities in Liquidfiles

CVE-2025-46093 — Critical (CVSS 9.9): LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to…
CVE-2020-29071 — Critical (CVSS 9.0): An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering…
CVE-2021-43397 — High (CVSS 8.8): LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.
CVE-2025-56132 — High (CVSS 7.3): LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The…
CVE-2023-4393 — Medium (CVSS 5.4): HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to…
CVE-2021-30140 — Medium (CVSS 5.4): LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an…

All CVEs affecting Liquidfiles →

Other CWE-829 vulnerabilities

CVE-2026-1699 — Critical (CVSS 10.0): In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used…
CVE-2025-70974 — Critical (CVSS 10.0): Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key…
CVE-2025-0982 — Critical (CVSS 10.0): Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute…
CVE-2021-41037 — Critical (CVSS 10.0): In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via…
CVE-2022-1161 — Critical (CVSS 10.0): An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix,…
CVE-2020-4561 — Critical (CVSS 10.0): IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This…

Browse all CWE-829 vulnerabilities →