Home

Description

Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces.

PUBLISHED Reserved 2026-01-28 | Published 2026-01-30 | Updated 2026-01-30 | Assigner VulnCheck




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
MEDIUM: 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Any version
affected

Credits

Benjamin Kunz Mejri finder

References

www.exploit-db.com/exploits/48466 (ExploitDB-48466) exploit

www.tryton.org/ (Official Tryton Homepage) product

www.tryton.org/download (Tryton Download Page) product

www.vulnerability-lab.com/get_content.php?id=2233 (Vulnerability Lab Advisory) third-party-advisory

www.vulncheck.com/.../tryton-persistent-cross-site-scripting (VulnCheck Advisory: Tryton 5.4 - Persistent Cross-Site Scripting) third-party-advisory

cve.org (CVE-2020-37014)

nvd.nist.gov (CVE-2020-37014)

Download JSON