Read the docs
TI-2020-17531 Aliases CVE-2020-29025GHSA-pfgj-h95w-gwmm

DOM-based Javascript injection

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3

Why it matters now

EPSS 0.00609 49th percentileScored 2026-11-07
Fix Fixed SiteManager Embedded (SM-E) (Secomea): 9.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SecomeaSiteManager Embedded (SM-E)all to before 9.39.3Patch availableCNA
  • SiteManager Embedded (SM-E) VendorSecomea Affected all to before 9.3 Fixed in 9.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:secomea:sitemanager_embedded:*:*:*:*:*:*:*:*before 9.2cVulnerableSecomea
  • cpe:2.3:a:secomea:sitemanager_embedded:*:*:*:*:*:*:*:* Versions before 9.2c Vulnerable ·Secomea

Remediation

  • Fix · CNA SiteManager Embedded (SM-E) (Secomea) Fixed in 9.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-29025
  2. 2026-10-03 Alias added: GHSA-pfgj-h95w-gwmm

References

Advisory 1

  • TI-2023-02730 SiteManager Embedded service disruption CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences