{"cve":"CVE-2020-26505","nvd":{"published":"2020-11-05T17:15:12.443","modified":"2026-06-17T03:08:06.680","status":"Modified","description":"A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://www.marmind.com/en/","https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1","https://www.marmind.com/en/","https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1"],"products":["marmind:marmind"],"source":"nvd","synced_at":"2026-10-19T21:11:20.317016139+00:00"},"epss":{"cve":"CVE-2020-26505","score":0.00709,"percentile":0.53519,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}