CVE-2020-29247

MediumCVSS 4.8/10Last modified Jul 9, 2026

Description

WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 24, 2020
Last modified
Jul 9, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-292496.1CXUUCMS V3 allows class="layui-input" XSS.CVE-2020-29254.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.19 and priorCVE-2020-292506.1CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.CVE-2020-292548.8TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a crossCVE-2020-292576.1Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the q parameter to feedback.php.CVE-2020-292586.1Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the w parameter to index.php.CVE-2020-292595.4Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feedback.php.CVE-2020-29264.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected aCVE-2020-292607.5libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().CVE-2020-29277.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected CVE-2020-292799.8PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 aCVE-2020-29284.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 an