CVE-2020-36497

Name of the Vulnerable Software and Affected Versions: DedeCMS version 7.5 SP2

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities found in the makehtml homepage.php component. These vulnerabilities can be exploited via the filename, mid, userid, and templet parameters.

Recommendations: For DedeCMS version 7.5 SP2, consider restricting access to the makehtml homepage.php component until a patch is available. As a temporary workaround, avoid using the filename, mid, userid, and templet parameters in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.