VULNERABILITY INTELLIGENCE

CVE-2020-37103

CVSS score6.4 MEDIUM

EPSS probability0.36%

CISA KEVNot currently listed

Published2026-02-03

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Description

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.

Weakness classification

disclosure@vulncheck.com: CWE-79

Primary references

disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Third Party Advisory
disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
disclosure@vulncheck.com — Third Party Advisory