CVE-2020-20640

6.1 mediumEPSS 0.9%

Medium (6.1) in shopex ecshop. EPSS 0.9% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss vulnerability.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-06-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

shopex:ecshop

References

https://www.jianshu.com/p/219755c047a1
https://www.jianshu.com/p/219755c047a1

Check your stack JSON