CVE-2019-20804: Gilacms Gila CMS

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account.

Affected products

• Gilacms Gila CMS: before 1.11.6 (fixed in 1.11.6)

Published 2020-05-21. Last modified 2026-06-17.