CVE-2020-20345

MediumCVSS 5.4

Published: 01/09/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

42th percentile - higher than 42% of all known CVEs

Summary

WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background, allowing attackers to steal cookies via a crafted payload in the search box.

Risk Assessment

An attacker can steal administrator session cookies, leading to account takeover and unauthorized access to the management panel.

Recommendation

Update WTCMS to the latest version and implement input filtering and encoding in the search box.

Original NVD description (English source)

WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain cookies via a crafted payload entered into the search box.