CVE-2020-20586

MediumCVSS 4.5

Published: 08/07/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability was found in XYHCMS V3.6 at the URI /xyhai.php?s=/Auth/editUser. It allows an attacker to modify administrator information, including name, email, and password.

Risk Assessment

An attacker can hijack the administrator account by changing login credentials, leading to full compromise of the CMS system and its stored data.

Recommendation

Immediately update XYHCMS to the latest version and implement CSRF protections such as anti-CSRF tokens and Origin header verification.

Original NVD description (English source)

A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password.