CVE-2020-24223

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/158728/Mara-CMS-7.5-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/FreySolarEye/CVE/blob/master/Mara%20CMS%207.5%20-%20Cross%20Site%20ScriptingExploit, Third Party Advisory
https://www.exploit-db.com/exploits/48777Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/158728/Mara-CMS-7.5-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/FreySolarEye/CVE/blob/master/Mara%20CMS%207.5%20-%20Cross%20Site%20ScriptingExploit, Third Party Advisory
https://www.exploit-db.com/exploits/48777Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Aug 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-242277.5Playground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text allowing anyone with access to UserProfile CVE-2020-242319.8Symmetric DS <3.12.0 uses mx4j to provide access to JMX over HTTP. mx4j, by default, has no auth and is available on all interfaces. An atta CVE-2020-242405.5GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: CVE-2020-242415.5In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.CVE-2020-242425.5In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok_text in asm/preproc.c by accessing READ memory.CVE-2020-242467.5Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from CVE-2020-242638.8Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-ad CVE-2020-242649.8Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction check CVE-2020-242657.5An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in MemcmpInterceptorCommon() that can mak CVE-2020-242667.5An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in get_l2len() that can make tcpprep cras CVE-2020-242718.8A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacus CVE-2020-242756.5A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.