Persistent Cross-Site Scripting in Kuicms Php EE 2.0
CVE-2020-37222

5.1MEDIUM

Key Information:

Vendor

Kuicms

Status
Kuicms PHP Ee
Vendor
CVE Published:
13 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-37222?

Kuicms Php EE 2.0 features a vulnerability that allows attackers to exploit a persistent cross-site scripting flaw. This vulnerability enables unauthenticated users to inject malicious scripts into the system by crafting specific content submitted through the bbs reply endpoint. When a POST request is sent to /web/?c=bbs&a=reply with HTML and JavaScript payloads in the content parameter, these scripts can execute in the browsers of users who access the compromised data, leading to significant security risks.

Affected Version(s)

Kuicms Php EE 2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-37222 - Proof of Concept

References

https://www.exploit-db.com/exploits/48526
exploit
https://kuicms.com
product
https://kuicms.com/kuicms.zip
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

China Banking and Insurance Information Technology Management Co., Ltd.
.