PT-2026-5856 · Davidvg+1 · 60Cyclecms

Unkn0Wn · Published 2026-02-03 · Updated 2026-02-18 · CVE-2020-37111

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions 60CycleCMS version 2.5.2

Description The software contains a cross-site scripting (XSS) issue in the news.php file. This allows attackers to inject malicious scripts through GET parameters. Attackers can create malicious URLs with XSS payloads targeting the etsu and ltsu parameters to execute arbitrary scripts in victim’s browsers. This does not involve SQL injection.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all input received through the etsu and ltsu parameters in the 'news.php' file.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-37111

Affected Products

60Cyclecms

References · 7

• 🔥 https://exploit-db.com/exploits/48177 · Exploit
• https://osv.dev/vulnerability/CVE-2020-37111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-37111 · Security Note
• http://davidvg.com · Note
• https://vulncheck.com/advisories/cyclecms-newsphp-cross-site-scripting-xss-vulnerability · Note
• https://opensourcecms.com/60cyclecms · Note
• https://t.me/cveNotify/152372 · Telegram Post