Read the docs
TI-2020-19372 Aliases CVE-2020-37237GHSA-85qg-778w-mp8h

Composr CMS 10.0.34 Persistent Cross-Site Scripting via banners

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the banner management interface. Attackers with admin credentials can inject XSS payloads in the Description field of the Add banner functionality, which execute for all website visitors when they access the home page.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CompoComposr CMS10.0.34—No fix listedCNA
  • Composr CMS VendorCompo Affected 10.0.34 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-37237
  2. 2026-10-03 Alias added: GHSA-85qg-778w-mp8h

References

Exploit 1

Other 2

  • TI-2021-16279 In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the… CVSS 3.1MEDIUM 6.1
  • TI-2021-16278 In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS. CVSS 3.1MEDIUM 5.4
  • TI-2018-04798 Composr CMS 10.0.13 has XSS via the site_name parameter in a… CVSS 3.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences