CVE-2020-29233

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page description and each time any user will visits the website, the XSS triggers and attacker can steal the cookie according to the crafted payload.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-292387.5An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information whe CVE-2020-292396.1Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker inject CVE-2020-29244.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 an CVE-2020-292404.8Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and ea CVE-2020-292414.8Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web s CVE-2020-292426.5dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.CVE-2020-292436.5dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.CVE-2020-292446.5dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.CVE-2020-292456.5dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.CVE-2020-292474.8WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and ea CVE-2020-292496.1CXUUCMS V3 allows class="layui-input" XSS.CVE-2020-29254.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.19 and prior