CVE-2020-37019 - Orchard Core RC1 - Persistent Cross-Site Scripting

Back Back to CVE browser

MEDIUM

Orchard Core RC1 - Persistent Cross-Site Scripting

Published Jan 30, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.46%

Description

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers.

Affected products

Vendor Orchardcore Product Orchard Core Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Orchardcore

Orchard Core

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

http://www.orchardcore.net/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30959
Advisory
https://github.com/OrchardCMS/OrchardCore
product
https://github.com/OrchardCMS/OrchardCore/issues/5802
issue-tracking
https://www.exploit-db.com/exploits/48456
exploit
https://www.vulncheck.com/advisories/orchard-core-rc-persistent-cross-site-scripting
third-party-advisory

Link	Providers	Tags
http://www.orchardcore.net/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30959		Advisory
https://github.com/OrchardCMS/OrchardCore		product
https://github.com/OrchardCMS/OrchardCore/issues/5802		issue-tracking
https://www.exploit-db.com/exploits/48456		exploit
https://www.vulncheck.com/advisories/orchard-core-rc-persistent-cross-site-scripting		third-party-advisory