CVE-2020-37240CWE-79cross-site-scripting

CVE-2020-37240

Medium · published May 16, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through user creation fields. Attackers can insert JavaScript payloads in the First Name, Last Name, and Email fields during user creation, which execute when viewing the User List page.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-16T20:16Z
References (4)
http://codekernel.net/ · [email protected]https://codecanyon.net/item/queue-management-system/22029961 · [email protected]https://www.exploit-db.com/exploits/49296 · [email protected]https://www.vulncheck.com/advisories/queue-management-system-stored-xss-via-add-user · [email protected]
EPSS history
Timeline
  • 16 MAY 15:25Z
    Queue Management System 4.0.0 Stored XSS via Add User
    cvelistv5