CVE-2020-25915: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

August 11, 2023 (updated August 16, 2023)

Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.

References

github.com/advisories/GHSA-4847-gqxx-v9xp
github.com/thinkcmf/thinkcmf/commit/27e1fbea5aed5619d15c1257614df45298f04436
github.com/thinkcmf/thinkcmf/issues/675
nvd.nist.gov/vuln/detail/CVE-2020-25915

Detect and mitigate CVE-2020-25915 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →