PT-2026-5856 · Davidvg+1 · 60Cyclecms

Unkn0Wn · Publicado 2026-02-03 · Atualizado 2026-02-18 · CVE-2020-37111

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions 60CycleCMS version 2.5.2

Description The software contains a cross-site scripting (XSS) issue in the news.php file. This allows attackers to inject malicious scripts through GET parameters. Attackers can create malicious URLs with XSS payloads targeting the etsu and ltsu parameters to execute arbitrary scripts in victim’s browsers. This does not involve SQL injection.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all input received through the etsu and ltsu parameters in the 'news.php' file.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2020-37111

Produtos afetados

60Cyclecms

Referências · 7

• 🔥 https://exploit-db.com/exploits/48177 · Exploit
• https://osv.dev/vulnerability/CVE-2020-37111 · Aviso do Fabricante
• http://davidvg.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-37111 · Nota de Segurança
• https://vulncheck.com/advisories/cyclecms-newsphp-cross-site-scripting-xss-vulnerability · Nota
• https://opensourcecms.com/60cyclecms · Nota
• https://t.me/cveNotify/152372 · Publicação no Telegram