CVE-2020-37019

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers.

CVSS v4.0

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

6.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2026-01-30

Updated

2026-06-23

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48456

References

• CVE Record
• NVD entry

Related

• CVE-2020-37018
• CVE-2020-37020
• CVE-2020-37017
• CVE-2020-37021
• CVE-2020-37016
• CVE-2020-37022