{"id":"CVE-2020-8656","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-8656","generatedAt":"2026-11-05T02:21:47.025Z","title":"The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.","description":"An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.","published":"2020-02-07T00:15:10.000Z","lastModified":"2026-06-17T03:26:43.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-89"],"affected":["eyesofnetwork/eyesofnetwork"],"epss":{"score":0.846,"percentile":0.99704,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":2,"verified":true,"firstPublished":"2020-02-07","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":48169,"kind":"exploit","title":"EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)","url":"https://www.exploit-db.com/exploits/48169","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/48169.rb","file":"exploits/multiple/remote/48169.rb","published":"2020-03-05","added":"2020-03-05","updated":"2020-03-05","author":"Metasploit","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["CVE-2020-8657","CVE-2020-8656","CVE-2020-8655","CVE-2020-8654"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb"},{"edbId":48025,"kind":"exploit","title":"EyesOfNetwork 5.3 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/48025","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/48025.txt","file":"exploits/php/webapps/48025.txt","published":"2020-02-07","added":"2020-02-07","updated":"2020-02-07","author":"Clément Billac","type":"webapps","platform":"php","port":null,"verified":false,"codes":["CVE-2020-8656","CVE-2020-8655","CVE-2020-8654"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 84.6%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/156266/EyesOfNetwork-5.3-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://github.com/EyesOfNetworkCommunity/eonapi/issues/16","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/156266/EyesOfNetwork-5.3-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/EyesOfNetworkCommunity/eonapi/issues/16","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-8656","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}