{"id":"CVE-2020-15263","aliases":["EUVD-2020-1411","GHSA-589w-hccm-265x"],"status":"published","title":"XSS in platform","description":"In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00748,"percentile":0.55174,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-10-19T20:17:47Z","modified":"2026-10-20T10:51:56Z","fixes":[{"ecosystem":"Packagist","package":"orchid/platform","fixed_in":["9.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"orchid/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.4.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"orchid/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.4.4"}]}],"versions":["9.0.0","9.0.1","9.0.2","9.0.3","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.4.1","9.4.2","9.4.3"]}],"products":[{"vendor":"orchid","product":"platform"},{"vendor":"orchidsoftware","product":"platform"},{"vendor":"runzero","product":"platform"}],"references":[{"url":"https://github.com/orchidsoftware/platform/security/advisories/GHSA-589w-hccm-265x","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/orchidsoftware/platform/commit/03f9a113b1a70bc5075ce86a918707f0e7d82169","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15263","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-589w-hccm-265x"}],"sources":{"cve":[{"id":"CVE-2020-15263","title":"XSS in platform","description":"In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.","status":"published","published":"2020-10-19T20:35:17Z","modified":"2024-08-04T13:15:20.026Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-1411","description":"In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.","status":"published","published":"2020-10-19T20:35:17Z","modified":"2024-08-04T13:15:20Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:07:31.955969Z"}],"ghsa":[{"id":"GHSA-589w-hccm-265x","title":"Inline attribute values were not processed.","description":"### Impact\nInline attributes have not been processed escape.\nIf the data that came from users was not processed, then an XSS vulnerability is possible\n\n### Patches\nFixed in 9.4.4","status":"published","published":"2020-10-19T20:17:47Z","modified":"2023-01-09T05:04:28Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"nvd":[{"id":"CVE-2020-15263","description":"In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.","status":"published","published":"2020-10-19T21:15:12.983Z","modified":"2026-06-17T02:56:23.28Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:20.704992Z"}],"osv":[{"id":"CVE-2020-15263","description":"In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.","status":"published","published":"2020-10-19T21:15:12.983Z","modified":"2026-10-20T10:51:56.158920627Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-589w-hccm-265x","title":"Inline attribute values were not processed.","description":"### Impact\nInline attributes have not been processed escape.\nIf the data that came from users was not processed, then an XSS vulnerability is possible\n\n### Patches\nFixed in 9.4.4","status":"published","published":"2020-10-19T20:17:47Z","modified":"2026-07-08T06:30:00.81312913Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}