CVE-2020-36906

MEDIUM

P5 FNIP-8x16A FNIP-4xSH 1.0.20 - CSRF

Title source: llm

Description

P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking authenticated users into loading a specially crafted form.

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textwebappshardware

https://www.exploit-db.com/exploits/48362

View Code ZIP pw:eip

References (7)

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/180252

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/180253

[Various Sources] https://packetstorm.news/files/id/157318

[Various Sources] https://www.p5.hu

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/48362

[Third Party Advisory] https://www.vulncheck.com/advisories/p-fnip-xa-fnip-xsh-cross-site-request-forgery-via-user-management

[Third Party Advisory] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5564.php

Scores

CVSS v3 4.3

EPSS 0.0002

EPSS Percentile 5.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-352

Status draft

Timeline

Published Jan 06, 2026

Tracked Since Feb 18, 2026