What’s Vulnerable › Vulnerabilities
CVE-2020-14988
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-03-11 · updated 2026-06-17
- Weakness: CWE-79
Description
An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript.
Affected products
- Bloomreach Experience Manager: from 14.1.0 through 14.2.2
References
Get alerted when CVE-2020-14988 or the next vulnerability affects your stack