CVE-2020-23046

MEDIUM

dedecms v7.5 SP2 - Stored Cross-Site Scripting via tpl.php Parameters

Title source: llm
STIX 2.1

Description

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, and `templet' parameters.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.vulnerability-lab.com/get_content.php?id=2194

Scores

CVSS v3 6.1
EPSS 0.0025
EPSS Percentile 48.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
dedecms/dedecms 7.5 sp2
Published Oct 22, 2021
Tracked Since Feb 18, 2026