CVE-2020-11094: Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar

medium Affects rainlab/debugbar-plugin. Feed 2026.10.29.1, updated 2026-10-28; published 2020-06-03; advisory modified 2026-07-08.

Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar

Package: rainlab/debugbar-plugin Composer
Affected versions: <3.1.0
Fixed in: 3.1.0
Severity: medium CVSS 6.1
Exploitation: not on CISA KEV · EPSS 1% (64.1th percentile)
Published: 2020-06-03
Source: osv.dev

References

CWE-532

NVD record rainlab/debugbar-plugin advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2020-35234 high The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, same weakness: CWE-532
CVE-2018-8719 medium An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to same weakness: CWE-532
CVE-2018-0504 medium Mediawiki information disclosure vulnerability same weakness: CWE-532
CVE-2018-7204 high inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activi same weakness: CWE-532
CVE-2018-10889 medium Moodle sensitive information disclosure same weakness: CWE-532
CVE-2012-1156 high Moodle backs up private files same weakness: CWE-532