CVE-2020-37111CWE-79

60CycleCMS 2.5.2 - 'news.php' Cross-site Scripting (XSS) Vulnerability

Medium · published February 3, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Attackers can craft malicious URLs with XSS payloads targeting the 'etsu' and 'ltsu' parameters to execute arbitrary scripts in victim's browsers. This issue does not involve SQL injection.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-03T16:52Z
EPSS history
Timeline
  • 03 FEB 16:52Z
    60CycleCMS 2.5.2 - 'news.php' Cross-site Scripting (XSS) Vulnerability
    cvelistv5