What’s Vulnerable › Vulnerabilities

CVE-2020-24026

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-18 · updated 2026-06-17
• Weakness: CWE-79

Description

TinyShop, a free and open source mall based on RageFrame2, has a stored XSS vulnerability that affects version 1.2.0. TinyShop allows XSS via the explain_first and again_explain parameters of the /evaluate/index.php page. The vulnerability may be exploited remotely, resulting in cross-site scripting (XSS) or information disclosure.

Affected products

• Tinyshop Project Tinyshop: 1.2.0

References

• https://github.com/jianyan74/TinyShop
• https://github.com/jianyan74/TinyShop/issues/14
• https://github.com/stavyan/TinyShop-UniApp
• https://github.com/jianyan74/TinyShop
• https://github.com/jianyan74/TinyShop/issues/14
• https://github.com/stavyan/TinyShop-UniApp

Get alerted when CVE-2020-24026 or the next vulnerability affects your stack