CVE-2020-37238CWE-79cross-site-scripting

CVE-2020-37238

Medium · published May 16, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG files containing embedded JavaScript to the file manager, which executes when other authenticated users access the uploaded file, enabling cookie theft and session hijacking.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-16T20:16Z
References (4)
https://www.cmsmadesimple.org/ · [email protected]https://www.cmsmadesimple.org/downloads · [email protected]https://www.exploit-db.com/exploits/49199 · [email protected]https://www.vulncheck.com/advisories/cms-made-simple-stored-xss-via-svg-file-upload · [email protected]
EPSS history
Timeline
  • 16 MAY 15:25Z
    CMS Made Simple 2.2.15 Stored XSS via SVG File Upload
    cvelistv5