PT-2026-5823 · Victoralagwu+1 · Cmssite+1

Published 2026-02-03 · Updated 2026-02-03 · CVE-2020-37072

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0

Description A stored cross-site scripting issue exists in the 'comment author' POST parameter. This allows attackers to submit crafted JavaScript payloads through the comment submission form to execute arbitrary code in the browsers of users who view the comments.

Recommendations As a temporary workaround, restrict or sanitize the input of the comment author parameter in the comment submission form. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-37072

Affected Products

Cmssite

Victor Cms

References · 5

• 🔥 https://exploit-db.com/exploits/48484 · Exploit
• https://osv.dev/vulnerability/CVE-2020-37072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-37072 · Security Note
• https://github.com/VictorAlagwu/CMSsite · Note
• https://vulncheck.com/advisories/victor-cms-commentauthor-persistent-cross-site-scripting · Note