{"id":"CVE-2020-25915","aliases":["EUVD-2023-2203","GHSA-4847-gqxx-v9xp"],"status":"published","title":"ThinkCMF Cross-site Scripting Vulnerability","description":"Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00441,"percentile":0.38662,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-08-11T00:00:00Z","modified":"2026-10-24T10:50:02Z","fixes":[{"ecosystem":"Packagist","package":"thinkcmf/thinkcmf","fixed_in":["5.1.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"thinkcmf/thinkcmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7"}]}]},{"source":"osv","ecosystem":"Packagist","package":"thinkcmf/thinkcmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7"}]}],"versions":["5.0-Beta","5.0-RC4","5.0.170607","5.0.170927","5.0.170927-rc","5.0.180103-beta","5.0.180115-RC","5.0.180123","5.0.180501","5.0.180508","5.0.180525","5.0.180626","5.0.180901","5.0.181212","5.0.181231","5.0.181231-beta","5.0.190111","5.0.190312","5.0.190419","5.0RC1","5.0RC2","5.0RC3","5.1.0-beta","v5.1.0","v5.1.1","v5.1.2","v5.1.3","v5.1.4","v5.1.5"]}],"products":[{"vendor":"thinkcmf","product":"thinkcmf"}],"references":[{"url":"https://github.com/thinkcmf/thinkcmf/issues/675","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25915","tags":["advisory"]},{"url":"https://github.com/thinkcmf/thinkcmf/commit/27e1fbea5aed5619d15c1257614df45298f04436","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4847-gqxx-v9xp"},{"url":"https://github.com/thinkcmf/thinkcmf","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-25915","description":"Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.","status":"published","published":"2023-08-11T00:00:00Z","modified":"2024-10-09T19:16:42.081Z","updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2023-2203","description":"Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.","status":"published","published":"2023-08-11T00:00:00Z","modified":"2024-10-09T19:16:42Z","updated_at":"2026-11-03T00:27:42.546269Z"}],"ghsa":[{"id":"GHSA-4847-gqxx-v9xp","title":"ThinkCMF Cross-site Scripting Vulnerability","description":"Cross Site Scripting (XSS) vulnerability in `UserController.php` in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted `user_login`.","status":"published","published":"2023-08-11T15:30:46Z","modified":"2023-11-09T05:05:47Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2020-25915","description":"Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.","status":"published","published":"2023-08-11T14:15:10.763Z","modified":"2026-06-17T03:07:27.153Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:47.910346Z"}],"osv":[{"id":"CVE-2020-25915","description":"Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.","status":"published","published":"2023-08-11T14:15:10.763Z","modified":"2026-10-24T10:50:02.026129316Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"GHSA-4847-gqxx-v9xp","title":"ThinkCMF Cross-site Scripting Vulnerability","description":"Cross Site Scripting (XSS) vulnerability in `UserController.php` in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted `user_login`.","status":"published","published":"2023-08-11T15:30:46Z","modified":"2024-02-16T08:01:26.392673Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}