CVE-2020-37019: Orchard Core RC1 - Persistent Cross-Site Scripting

Published Jan 30, 2026

Updated

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers.

Affected Software

1 affected component

Orchard Orchard Core

Event History

Jan 30, 2026

CVE Published

via MITRE·04:16 PM

Data Sourced

via MITRE·04:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-37019?

CVE-2020-37019 is classified as a medium severity vulnerability due to its potential for remote exploitation.

How do I fix CVE-2020-37019?

To fix CVE-2020-37019, update to the latest version of Orchard Core that addresses this persistent cross-site scripting vulnerability.

What type of vulnerability is CVE-2020-37019?

CVE-2020-37019 is a persistent cross-site scripting (XSS) vulnerability.

What can an attacker do with CVE-2020-37019?

An attacker exploiting CVE-2020-37019 can inject malicious scripts through blog posts, affecting users who view the content.

Which software is affected by CVE-2020-37019?

CVE-2020-37019 affects Orchard Core RC1 software.