CVE-2020-25878: XSS

Published Jul 9, 2021

Updated

A stored cross site scripting (XSS) vulnerability in the 'Admin-Tools' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the 'Output Filters' and 'Droplets' modules.

Affected Software

1 affected component

Blackcat-cms Blackcat Cms=1.3.6

Event History

Jul 9, 2021

CVE Published

via MITRE·09:55 PM

Data Sourced

via MITRE·09:55 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2020-25878.

What is the severity level of CVE-2020-25878?

The severity level of CVE-2020-25878 is medium with a CVSS score of 4.8.

How does the vulnerability impact BlackCat CMS?

The vulnerability allows authenticated attackers to execute arbitrary web scripts or HTML in the 'Admin-Tools' feature of BlackCat CMS 1.3.6.

How can the vulnerability be exploited?

The vulnerability can be exploited by crafting and entering payloads into the 'Output Filters' and 'Droplets' modules of the 'Admin-Tools' feature.

Is there a fix available for CVE-2020-25878?

Yes, a fix is available for CVE-2020-25878. It is recommended to update to a version of BlackCat CMS that is not affected by this vulnerability.