CVE-2020-36496

Name of the Vulnerable Software and Affected Versions: DedeCMS version 7.5 SP2

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities found in the sys admin user edit.php component. These vulnerabilities can be exploited via the filename, mid, userid, and templet parameters.

Recommendations: For DedeCMS version 7.5 SP2, consider disabling the sys admin user edit.php component or restricting access to it until a patch is available. Avoid using the filename, mid, userid, and templet parameters in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.