CVE-2020-37237 MEDIUM

CVE-2020-37237: Composr CMS 10.0.34 Persistent Cross-Site Scripting via banners

Vendor Compo

Product Composr CMS

Weakness CWE-79 · XSS

Published May 16, 2026

Last update May 24, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the banner management interface. Attackers with admin credentials can inject XSS payloads in the Description field of the Add banner functionality, which execute for all website visitors when they access the home page.

Key dates

02Disclosure timeline

May 16, 2026 CVE published

May 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-37237 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-68401 ChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeover CVE-2024-4672 Campcodes Complete Web-Based School Management System show_student_subject.php cross site scripting CVE-2025-8567 Nexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVE-2026-41430 Press vulnerable to reflected XSS on login redirection CVE-2023-38500 By-passing Cross-Site Scripting Protection in HTML Sanitizer