CVE-2020-25104: Eramba

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension.

Affected products

• Eramba Eramba: version 2.8.1 only; version 2.19.3 only

Published 2020-09-03. Last modified 2026-06-17.