CVE-2020-18324

MediumCVSS 6.1

Published: 04/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.12%

80th percentile - higher than 80% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. An attacker can inject malicious JavaScript code that executes in the victim's browser.

Risk Assessment

The risk includes session hijacking, redirection to malicious sites, or theft of sensitive data. Both administrators and regular users of the system may be affected.

Recommendation

Update Subrion CMS to the latest version that includes a fix for this vulnerability. If an update is not possible, manually sanitize the q parameter in the Kickstart template to remove dangerous characters.

Original NVD description (English source)

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.