CVE-2020-24860

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.cmsmadesimple.orgProduct
https://www.exploit-db.com/exploits/48851Exploit, Third Party Advisory, VDB Entry
https://www.youtube.com/watch?v=M6D7DmmjLak&t=22sExploit, Third Party Advisory
http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.cmsmadesimple.orgProduct
https://www.exploit-db.com/exploits/48851Exploit, Third Party Advisory, VDB Entry
https://www.youtube.com/watch?v=M6D7DmmjLak&t=22sExploit, Third Party Advisory

Timeline

Published: Oct 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-248615.4GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create CVE-2020-248627.5The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via th CVE-2020-248635.5A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, an CVE-2020-248708.8Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.CVE-2020-248726.1Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitra CVE-2020-248769.8Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote pr CVE-2020-248779.8A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.CVE-2020-248819.8SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.CVE-2020-248897.8A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-CVE-2020-248905.5libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent a CVE-2020-248978.9The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HT CVE-2020-248986.5The Table Filter and Charts for Confluence Server app before 5.3.26 (for Atlassian Confluence) allows SSRF via the "Table from CSV" macro (U