CVE-2020-37111: Opensourcecms 60cyclecms

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Attackers can craft malicious URLs with XSS payloads targeting the 'etsu' and 'ltsu' parameters to execute arbitrary scripts in victim's browsers. This issue does not involve SQL injection.

Affected products

• Opensourcecms 60cyclecms: version 2.5.2 only

Published 2026-02-03. Last modified 2026-06-17.