nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-36931 CVE-2020-36931
MEDIUM
Click2Magic 1.1.5 - Stored Cross-Site Scripting
Record summary
CVE-2020-36931 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
Click2Magic 1.1.5 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts in the chat name input. Attackers can craft a malicious payload in the chat name to capture administrator cookies when the admin processes user requests.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 26, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Click2MagicBrowse Click2Magic / Click2Magic | CVE List | Through 1.1.5 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBClick2Magic 1.1.5 - Stored Cross-Site ScriptingExploitDB exploitby Shivam VermaNot analyzed1 file
References
5Official Product Websiteproduct
https://www.click2magic.com/ Vendor Homepageproduct
https://www.click2magic.com/user/agent/index ExploitDB-49347exploit
https://www.exploit-db.com/exploits/49347 VulnCheck Advisory: Click2Magic 1.1.5 - Stored Cross-Site ScriptingThird-party advisory
https://www.vulncheck.com/advisories/clickmagic-stored-cross-site-scripting