CVE-2020-26505

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-11-05 · updated 2026-06-17
Weakness: CWE-79

Description

A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS.

Affected products

Marmind: 4.1.141.0

References

https://www.marmind.com/en/
https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1
https://www.marmind.com/en/
https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1

Get alerted when CVE-2020-26505 or the next vulnerability affects your stack