CVE-2020-37072 Victor CMS 1.0 - 'comment_author' Persistent Cross-Site Scripting

Medium 5.1 Published 3 Feb 2026 Updated 4 Feb 2026

Attackers can inject malicious scripts via the comment_author parameter in Victor CMS, leading to arbitrary code execution in victim browsers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-37072?

CVE-2020-37072 is a medium-severity cross-site scripting vulnerability in VictorAlagwu CMSsite, published on 3 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts. Attackers can submit crafted JavaScript payloads through the comment submission form to execute arbitrary code in victim browsers.

Weakness: CWE-79

Which versions are affected by CVE-2020-37072?

It affects 1 product.

Products include Victor Cms Project Victor Cms.

How do I fix CVE-2020-37072?

No fix has been published for CVE-2020-37072 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-37072 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37072 exists.

Sources

Also known as GHSA-v5w7-x5c5-8hg8.