6.1
CVE-2020-37111
- EPSS 0.26%
- Veröffentlicht 03.02.2026 16:52:44
- Zuletzt bearbeitet 18.02.2026 16:38:58
- Quelle disclosure@vulncheck.com
- CVE-Watchlists
- Unerledigt
Login60CycleCMS 2.5.2 - 'news.php' Cross-site Scripting (XSS) Vulnerability
60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Attackers can craft malicious URLs with XSS payloads targeting the 'etsu' and 'ltsu' parameters to execute arbitrary scripts in victim's browsers. This issue does not involve SQL injection.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensourcecms ≫ 60cyclecms Version2.5.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.26% | 0.165 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| disclosure@vulncheck.com | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| disclosure@vulncheck.com | 5.1 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://www.exploit-db.com/exploits/48177
https://www.opensourcecms.com/60cyclecms
http://davidvg.com/
https://www.vulncheck.com/advisories/cyclecms-newsphp-cross-site-scripting-xss-vulnerability