CVE-2020-37019

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-37026.5u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with CVE-2020-370207.8SonarQube 8.3.1 contains an unquoted service path vulnerability that allows local attackers to gain SYSTEM privileges by exploiting the serv CVE-2020-370217.810-Strike Bandwidth Monitor 3.9 contains an unquoted service path vulnerability in multiple services that allows local attackers to escalate CVE-2020-370226.4OpenZ ERP 3.6.60 contains a persistent cross-site scripting vulnerability in the Employee module's name and description parameters. Attacker CVE-2020-370238.8Koken CMS 0.22.24 contains a file upload vulnerability that allows authenticated attackers to bypass file extension restrictions by renaming CVE-2020-370248.4Nidesoft DVD Ripper 5.2.18 contains a local buffer overflow vulnerability in the License Code registration parameter that allows attackers t CVE-2020-370258.4Port Forwarding Wizard 4.8.0 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code through a long r CVE-2020-370265.3Sickbeard alpha contains a cross-site request forgery vulnerability that allows attackers to disable authentication by submitting crafted co CVE-2020-370279.8Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands throug CVE-2020-370288.4Socusoft Photo to Video Converter Professional 8.07 contains a local buffer overflow vulnerability in the 'Output Folder' input field that a CVE-2020-370298.4FTPDummy 4.80 contains a local buffer overflow vulnerability in its preference file handling that allows attackers to execute arbitrary code CVE-2020-37039.8u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central