PT-2026-4649 · Unknown · Click2Magic

Shivam Verma · Published 2026-01-25 · Updated 2026-01-25 · CVE-2020-36931

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Click2Magic version 1.1.5

Description The software contains a stored cross-site scripting issue that allows attackers to inject malicious scripts through the chat name input. An attacker can create a malicious payload within the chat name to obtain administrator cookies when the administrator handles user requests. The vulnerable input is the chat name. The attack involves capturing administrator cookies.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user-supplied input for the chat name field to prevent script injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-36931

Affected Products

Click2Magic

References · 6

• 🔥 https://exploit-db.com/exploits/49347 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36931 · Security Note
• https://vulncheck.com/advisories/clickmagic-stored-cross-site-scripting · Note
• https://click2magic.com · Note
• https://click2magic.com/user/agent/index · Note
• https://t.me/cveNotify/149803 · Telegram Post