What’s Vulnerable › Vulnerabilities

CVE-2020-37240: Queue Management System 4.0.0 Stored XSS via Add User

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-16 · updated 2026-09-29
• Weakness: CWE-79

Description

Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through user creation fields. Attackers can insert JavaScript payloads in the First Name, Last Name, and Email fields during user creation, which execute when viewing the User List page.

Affected products

• Codekernel Queue Management System: 4.0.0

References

• http://codekernel.net/
• https://codecanyon.net/item/queue-management-system/22029961
• https://www.exploit-db.com/exploits/49296
• https://www.vulncheck.com/advisories/queue-management-system-stored-xss-via-add-user

Get alerted when CVE-2020-37240 or the next vulnerability affects your stack