CVE-2020-29146: Wayang-CMS Project Wayang-CMS

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header.

Affected products

• Wayang-CMS Project Wayang-CMS: version 1.0 only

Published 2021-07-14. Last modified 2026-06-17.