Home

Description

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers.

PUBLISHED Reserved 2026-01-28 | Published 2026-01-30 | Updated 2026-01-30 | Assigner VulnCheck




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
MEDIUM: 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

1.0
affected

Credits

SunCSR (Sun* Cyber Security Research) finder

References

www.exploit-db.com/exploits/48456 (ExploitDB-48456) exploit

www.orchardcore.net/ (Orchard Core Official Website) product

github.com/OrchardCMS/OrchardCore (Orchard Core GitHub Repository) product

github.com/OrchardCMS/OrchardCore/issues/5802 (GitHub Issue #5802) issue-tracking patch

www.vulncheck.com/...core-rc-persistent-cross-site-scripting (VulnCheck Advisory: Orchard Core RC1 - Persistent Cross-Site Scripting) third-party-advisory

cve.org (CVE-2020-37019)

nvd.nist.gov (CVE-2020-37019)

Download JSON