CVE-2020-20584

MediumCVSS 6.1

Published: 08/07/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.13%

62th percentile - higher than 62% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was found in baigo CMS v4.0-beta-1. Attackers can inject arbitrary JavaScript or HTML code via the 'post' parameter sent to /public/console/profile/info-submit/.

Risk Assessment

The risk involves executing arbitrary scripts in the victim's browser, potentially leading to session theft, admin account takeover, or sensitive data leakage.

Recommendation

Immediately upgrade baigo CMS to the latest stable version containing security fixes. If an upgrade is not possible, apply input filtering and validation for the 'post' parameter.

Original NVD description (English source)

A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/console/profile/info-submit/.