CVE-2020-28365: Sapplica Sentrifugo

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process. When an administrator looks at logs, the payload is executed. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

• Sapplica Sentrifugo: version 3.2 only

Published 2020-12-30. Last modified 2026-06-17.