CVE-2020-37019

Orchard Core RC1 - Persistent Cross-Site Scripting

Medium5.1EPSS 0.47%

Published: 30 Jan 2026
Updated: 23 Jun 2026
Reserved: 28 Jan 2026
Assigned by: VulnCheck

Description

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers.

Scores

CVSS scores of CVE-2020-37019, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
VulnCheckCNA (assigner)	3.1	Medium6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVDNVD · Deferred	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.47% · top 59% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

Orchardcore · Orchard Core
- affected 1.0

References (5)

ExploitDB-48456 (opens in a new tab)exploit
Orchard Core Official Website (opens in a new tab)product
Orchard Core GitHub Repository (opens in a new tab)product
GitHub Issue #5802 (opens in a new tab)issue-tracking
VulnCheck Advisory: Orchard Core RC1 - Persistent Cross-Site Scripting (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-37019](https://trackcve.app/badge/CVE-2020-37019.svg)](https://trackcve.app/cve/CVE-2020-37019)

Record last updated 23 Jun 2026, 16:13 UTC.