Medium severity · published Apr 28, 2021
CVE-2020-18022
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in…
6.1
CVSS
1.2%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QI
Qibocms · Qibosoft
v7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-18022
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-18022
Exploit
https://github.com/hpj233/qibocms/blob/master/v7
More from Qibocms
8.8
CVE-2023-27037
Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at label_set_rs.php