CVE-2020-7050: Codologic Codoforum

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cookies and take over accounts.

Affected products

• Codologic Codoforum: up to and including 4.8.4

Published 2020-02-15. Last modified 2026-06-17.