CVE-2020-37111 60CycleCMS 2.5.2 - 'news.php' Cross-site Scripting (XSS) Vulnerability
Attackers can inject malicious scripts via GET parameters in news.php, allowing arbitrary script execution in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-37111?
CVE-2020-37111 is a medium-severity cross-site scripting vulnerability in Davidvg 60CycleCMS, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Attackers can craft malicious URLs with XSS payloads targeting the 'etsu' and 'ltsu' parameters to execute arbitrary scripts in victim's browsers. This issue does not involve SQL injection.
Weakness: CWE-79
Which versions are affected by CVE-2020-37111?
It affects 1 product.
Products include Opensourcecms 60cyclecms.
How do I fix CVE-2020-37111?
No fix has been published for CVE-2020-37111 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-37111 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37111 exists.
Other vulnerabilities in Davidvg 60CycleCMS
Sources
Also known as GHSA-jvr8-79f6-p83g.