CVE-2020-36932

5.1 mediumEPSS 0.3%

Medium (5.1) in seacms seacms. EPSS 0.3% chance of exploitation in the next 30 days.

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-01-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

seacms:seacms

References

https://www.exploit-db.com/exploits/49251
https://www.seacms.net/
https://www.vulncheck.com/advisories/seacms-checkuser-stored-xss

Check your stack JSON