← Vulnerability feed

Vulnerability record · CVE-2020-27886 · published 29 October 2020

CVE-2020-27886: Eyesofnetwork sql injection vulnerability

EEyesofnetwork · Eyesofnetwork

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the username_available function of the includes/functions.php file (which is called by login.php).

9.8 CVSS 3.1 Critical EPSS 1.7% · top 23.7% CWE-89 · SQL injection
9.8CVSS 3.1 base score, v2 7.5
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the username_available function of the includes/functions.php file (which is called by login.php).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x86_64-bin.iso PatchProductVendor Advisory
https://github.com/EyesOfNetworkCommunity/eonweb/issues/76 Third Party Advisory
https://www.eyesofnetwork.com/en Product
http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x86_64-bin.iso PatchProductVendor Advisory
https://github.com/EyesOfNetworkCommunity/eonweb/issues/76 Third Party Advisory
https://www.eyesofnetwork.com/en Product

Track CVE-2020-27886 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-8657EyesOfNetwork hardcoded API key allows admin token forgeryEyesOfNetwork 5.3 ships with a hardcoded API key (EONAPI_KEY in include/api_functions.php for API version 2.4.2) that is identical across all install…KEVEPSS 92%analysed7.8CVE-2020-8655EyesOfNetwork sudoers misconfiguration allows apache-to-root privilege escalationEyesOfNetwork 5.3 ships a sudoers configuration that lets the apache user run arbitrary commands as root through a crafted NSE script for nmap 7. Bec…KEVEPSS 60%analysed9.8CVE-2022-41572Eyesofnetwork incorrect default permissions vulnerabilityAn issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server because nmap can be run as root…EPSS 0.59%9.8CVE-2022-41570Eyesofnetwork sql injection vulnerabilityAn issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.EPSS 0.79%9.8CVE-2022-41571Eyesofnetwork vulnerabilityAn issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.EPSS 1.1%9.8CVE-2021-40643Eyesofnetwork vulnerabilityEyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" a…EPSS 2.9%9.8CVE-2021-27514Eyesofnetwork improper restriction of authentication attempts vulnerabilityEyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (s…EPSS 3.5%9.8CVE-2020-9465EyesOfNetwork eonweb SQL injection allows unauthenticated auth bypassEyesOfNetwork eonweb versions 5.1 through 5.3 before 5.3-3 contain a SQL injection in the web interface. The user_id field in a cookie is injectable,…EPSS 82%analysed

Source: NIST National Vulnerability Database (record CVE-2020-27886), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.