CVE-2020-21494

MEDIUM

Xiuno BBS 4.0.4 - Cross-Site Scripting via Install Component Doctype Manipulation

Title source: llm
STIX 2.1

Description

A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via changing the doctype value to 0.

References (2)

Core 2
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://gitee.com/xiuno/xiunobbs/issues/I16BHH
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/wanghaiwei/xiuno-docker/issues/4

Scores

CVSS v3 6.1
EPSS 0.0031
EPSS Percentile 54.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
xiuno/xiunobbs 4.0.4
Published Oct 04, 2021
Tracked Since Feb 18, 2026