CVE-2020-18125

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Indexhibit/indexhibit/issues/20Exploit, Issue Tracking, Third Party Advisory
https://github.com/Indexhibit/indexhibit/issues/20Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Aug 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-181265.4Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary CVE-2020-181276.5An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.CVE-2020-181298.8A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.CVE-2020-18136.8HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. Due to improper au CVE-2020-181318.8Cross Site Request Forgery (CSRF) vulnerability in Bluethrust Clan Scripts v4 allows attackers to escilate privledges to an arbitrary accoun CVE-2020-181324.8Cross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryE CVE-2020-18145.3Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C CVE-2020-181449.8SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.CVE-2020-181456.1Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php.CVE-2020-18157.5Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C CVE-2020-181516.5Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.CVE-2020-181559.8SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.