CVE-2020-15183CWE-79

Reflected XSS leading to RCE in SoyCMS

High · published September 17, 2020

CVSS v3.1
8.4
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01747 · 77.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-09-17T20:10Z
EPSS history
Timeline
  • 17 SEP 20:10Z
    Reflected XSS leading to RCE in SoyCMS
    cvelistv5