CVE-2020-36905: Fibar Group S.a Home Center 2

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.

Affected products

• Fibar Group S.a Home Center 2: up to and including 5.021.38
• Fibar Group S.a Home Center 3: up to and including 5.021.38
• Fibar Group S.a Home Center Lite: up to and including 5.021.38

Published 2026-01-06. Last modified 2026-06-17.