CVE-2020-19511

MediumCVSS 6.1

Published: 21/06/2021(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.82%

53th percentile - higher than 53% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in Typesetter 5.1 via the className and Description fields in index.php/Admin/Classes. An attacker can inject malicious JavaScript code that executes in the victim's browser.

Risk Assessment

The risk includes potential session hijacking, redirection to malicious sites, or other actions performed in the context of an administrator session, potentially leading to full CMS compromise.

Recommendation

Immediately update Typesetter to the latest patched version. If an update is not possible, manually sanitize input data in the className and Description fields before rendering.

Original NVD description (English source)

Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,