CVE-2020-37111

5.1 mediumEPSS 0.3%

Medium (5.1) in opensourcecms 60cyclecms. EPSS 0.3% chance of exploitation in the next 30 days.

60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Attackers can craft malicious URLs with XSS payloads targeting the 'etsu' and 'ltsu' parameters to execute arbitrary scripts in victim's browsers. This issue does not involve SQL injection.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-02-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

opensourcecms:60cyclecms

References

http://davidvg.com/
https://www.exploit-db.com/exploits/48177
https://www.opensourcecms.com/60cyclecms
https://www.vulncheck.com/advisories/cyclecms-newsphp-cross-site-scripting-xss-vulnerability

Check your stack JSON