CVE-2020-15263: XSS in platform

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-19 · updated 2026-06-17
Weakness: CWE-79

Description

In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.

Affected products

orchidsoftware platform: from 9.0.0 before 9.4.4 — fixed in 9.4.4

How to fix

Upgrade to a fixed version: orchidsoftware platform 9.4.4. Check the vendor advisory for mitigations.

References

https://github.com/orchidsoftware/platform/commit/03f9a113b1a70bc5075ce86a918707f0e7d82169
https://github.com/orchidsoftware/platform/security/advisories/GHSA-589w-hccm-265x
https://github.com/orchidsoftware/platform/commit/03f9a113b1a70bc5075ce86a918707f0e7d82169
https://github.com/orchidsoftware/platform/security/advisories/GHSA-589w-hccm-265x

Get alerted when CVE-2020-15263 or the next vulnerability affects your stack