CVE-2020-25878

MEDIUM

BlackCat CMS 1.3.6 - Authenticated Stored Cross-Site Scripting via Admin-Tools Output Filters and Droplets

Title source: llm

Description

A stored cross site scripting (XSS) vulnerability in the 'Admin-Tools' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the 'Output Filters' and 'Droplets' modules.

References (2)

Core 2

Core References

Product x_refsource_misc

https://blackcat-cms.org/

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/BlackCatDevelopment/BlackCatCMS/issues/402

Scores

CVSS v3 4.8

EPSS 0.0054

EPSS Percentile 41.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

blackcat-cms/blackcat_cms 1.3.6

Published Jul 09, 2021

Tracked Since Feb 18, 2026