CVE-2020-37256

MediumCVSS 5.4/10Last modified Oct 8, 2026

Description

Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-37268.8Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary codeCVE-2020-372677.5Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs CVE-2020-372686.3Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the calleCVE-2020-37278.8Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary codeCVE-2020-372776.5PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() methCVE-2020-372787.5Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the CVE-2020-372798.1easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting sheCVE-2020-37288.8Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary codeCVE-2020-372807.5cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checkCVE-2020-372818.1Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impeCVE-2020-372829.8office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a craftCVE-2020-372846.1Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts