CVE-2020-37019CWE-79

Orchard Core RC1 - Persistent Cross-Site Scripting

Medium · published January 30, 2026

CVSS v4.0

5.1

EPSS

Percentile

39.1

In the wild

Unconfirmed

What it is

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers.

The record

Technical detail

CVSS v4.0: 5.1 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS: 0.00462 · 39.1th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-01-30T16:16Z

EPSS history

Timeline

30 JAN 16:16Z
Orchard Core RC1 - Persistent Cross-Site Scripting
cvelistv5