CVE-2020-37103

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-371047.5ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by pred CVE-2020-371057.1PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrar CVE-2020-371065.3Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles witho CVE-2020-371077.5Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field w CVE-2020-371087.1PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to m CVE-2020-371097.5aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Subjec CVE-2020-37117.8Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code CVE-2020-371109.860CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queries CVE-2020-371116.160CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through G CVE-2020-371126.5GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries thr CVE-2020-371138.8GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php CVE-2020-371146.5GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, applica