Vulnerability · Published May 16, 2026 · Assigned by VulnCheck
CVE-2020-37236NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel
Medium 6.4
In plain English
A medium-severity cross-site scripting in NewsLister from Netartmedia. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
NewsLister contains an authenticated persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the title parameter in the news addition interface. Attackers can inject JavaScript payloads via the title field in the admin panel that execute when news items are viewed by other users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Netartmedia | NewsLister | 1.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- ExploitDB-49160 exploit
- Official Product Homepage product
- VulnCheck Advisory: NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel third-party-advisory