CVE-2020-25877

MEDIUM

BlackCat CMS 1.3.6 - Authenticated Stored Cross-Site Scripting via Add Page Title Parameter

Title source: llm
STIX 2.1

Description

A stored cross site scripting (XSS) vulnerability in the 'Add Page' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/BlackCatDevelopment/BlackCatCMS/issues/401
Product x_refsource_misc
https://blackcat-cms.org/

Scores

CVSS v3 5.4
EPSS 0.0051
EPSS Percentile 39.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
blackcat-cms/blackcat_cms 1.3.6
Published Jul 09, 2021
Tracked Since Feb 18, 2026