Critical

DATE	CVE	VULNERABILITY TITLE	RISK
2020-12-17	CVE-2020-12517	Cross-site Scripting vulnerability in Phoenixcontact Plcnext Firmware On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation). network low complexity phoenixcontact CWE-79 critical	9.0
2020-12-17	CVE-2020-12519	Improper Privilege Management vulnerability in Phoenixcontact Plcnext Firmware On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. network low complexity phoenixcontact CWE-269 critical	9.8