What is the CVSS score of CVE-2020-37072?

CVE-2020-37072 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Victor Cms are affected by CVE-2020-37072?

Victor CMS 1.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through comment submissions, potentially compromising user sessions and data.

Is there a public PoC exploit available for CVE-2020-37072?

Yes, a public proof-of-concept exploit is available for CVE-2020-37072. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2020-37072?

Within 24 hours: Audit all comment submissions in Victor CMS for malicious payloads and disable public comment functionality if possible. Within 7 days: Deploy WAF rules to block JavaScript injection patterns in comment parameters; implement input validation and output encoding on the comment_author field. Within 30 days: Evaluate alternative CMS solutions or prepare for vendor patch release; conduct security awareness training for users on phishing risks from compromised comments; perform forensic analysis of logs for exploitation evidence.

Victor Cms CVE-2020-37072

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-03 disclosure@vulncheck.com

XSS Victor Cms Victor Cms Project

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 10, 2026 - 14:52 vuln.today

Public exploit code

CVE Published

Feb 03, 2026 - 22:16 nvd

HIGH 7.2

DescriptionCVE.org

Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts. Attackers can submit crafted JavaScript payloads through the comment submission form to execute arbitrary code in victim browsers.

AnalysisAI

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Victor Cms. Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts. Attackers can submit crafted JavaScript payloads through the comment submission form to execute arbitrary code in victim browsers.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.