CVE-2020-29240

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be triggered.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-292414.8Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web s CVE-2020-292426.5dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.CVE-2020-292436.5dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.CVE-2020-292446.5dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.CVE-2020-292456.5dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.CVE-2020-292474.8WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and ea CVE-2020-292496.1CXUUCMS V3 allows class="layui-input" XSS.CVE-2020-29254.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.19 and prior CVE-2020-292506.1CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.CVE-2020-292548.8TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross CVE-2020-292576.1Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the q parameter to feedback.php.CVE-2020-292586.1Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the w parameter to index.php.