CVE-2020-19158

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-15 · updated 2026-06-17
Weakness: CWE-79

Description

Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin/#/app/config/'.

Affected products

S-CMS: 2019-10-14

References

https://github.com/TL-swallow/swallow/blob/master/S-CMS%20XSS1.docx
https://github.com/TL-swallow/swallow/blob/master/S-CMS%20XSS1.docx

Get alerted when CVE-2020-19158 or the next vulnerability affects your stack