What’s Vulnerable › Vulnerabilities

CVE-2020-37237: Composr CMS 10.0.34 Persistent Cross-Site Scripting via banners

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-16 · updated 2026-09-29
• Weakness: CWE-79

Description

Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the banner management interface. Attackers with admin credentials can inject XSS payloads in the Description field of the Add banner functionality, which execute for all website visitors when they access the home page.

Affected products

• Composr CMS: 10.0.34

References

• https://compo.sr/
• https://compo.sr/download.htm
• https://www.exploit-db.com/exploits/49190
• https://www.vulncheck.com/advisories/composr-cms-persistent-cross-site-scripting-via-banners

Get alerted when CVE-2020-37237 or the next vulnerability affects your stack