CVE-2020-37111

MEDIUM

60CycleCMS 2.5.2 - Cross-Site Scripting via news.php GET Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-37111. PoCs published by Unkn0wn.

AI-analyzed exploit summary The code describes SQL injection and XSS vulnerabilities in 60CycleCMS 2.5.2, detailing affected functions and code paths in `lib.php` and `news.php`. It provides technical analysis of the vulnerabilities but does not include functional exploit code.

Description

60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Attackers can craft malicious URLs with XSS payloads targeting the 'etsu' and 'ltsu' parameters to execute arbitrary scripts in victim's browsers. This issue does not involve SQL injection.

Exploits (1)

exploitdb WRITEUP
by Unkn0wn · textwebappsphp
https://www.exploit-db.com/exploits/48177

The code describes SQL injection and XSS vulnerabilities in 60CycleCMS 2.5.2, detailing affected functions and code paths in `lib.php` and `news.php`. It provides technical analysis of the vulnerabilities but does not include functional exploit code.

Classification
Writeup 90%
Attack Type
Sqli | Xss
Complexity
Trivial
Reliability
Theoretical
Target: 60CycleCMS 2.5.2
No auth needed
Prerequisites: Access to the vulnerable web application
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit
https://www.exploit-db.com/exploits/48177
Various Sources product
http://davidvg.com/

Scores

CVSS v3 6.1
EPSS 0.0026
EPSS Percentile 16.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
Davidvg/60CycleCMS 2.5.2
opensourcecms/60cyclecms 2.5.2
Published Feb 03, 2026
Tracked Since Feb 18, 2026