What’s Vulnerable › Vulnerabilities

CVE-2020-15183: Reflected XSS leading to RCE in SoyCMS

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-09-17 · updated 2026-06-17
• Weakness: CWE-79

Description

SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.

Affected products

• Soycms Project Soycms: through 3.0.2

References

• https://github.com/inunosinsi/soycms/commit/045a222016f99b56557b0d8f39bbfc653d2c4707
• https://github.com/inunosinsi/soycms/security/advisories/GHSA-33q6-4xmp-2f48
• https://youtu.be/uAMAwH35ups
• https://github.com/inunosinsi/soycms/commit/045a222016f99b56557b0d8f39bbfc653d2c4707
• https://github.com/inunosinsi/soycms/security/advisories/GHSA-33q6-4xmp-2f48
• https://youtu.be/uAMAwH35ups

Get alerted when CVE-2020-15183 or the next vulnerability affects your stack