Medium
Security advisory
An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a malicious URL that executes a JavaScript payload in a victim's browser.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-26885
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 11:10 UTC · Revision 1
Source evidence
An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a malicious URL that executes a JavaScript payload in a victim's browser.
osv:CVE-2020-26885
Complete source record
{
"id": "a89409b9e4968055dc4e7fea8a9cd5b9c112d8c94a104e859756e71dd9dc729c",
"url": "https://osv.dev/vulnerability/CVE-2020-26885",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-26885",
"summary": "An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a malicious URL that executes a JavaScript payload in a victim's browser.",
"evidence": "osv:CVE-2020-26885",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-26885",
"aliases": [
"CVE-2020-26885"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/2sic/2sxc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "25e9e828e8c73573f29e9d2a72f46669dab3a06a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:2sic:2sxc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.00.00"
},
{
"fixed": "11.22.00"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v11.21.02",
"v11.21.01",
"v11.21.00",
"v11.20.00",
"v11.12.01",
"v11.12.00",
"v11.11.04",
"v11.11.03",
"v11.11.03-quick3",
"v11.11.03-quick2",
"v11.11.03-quick1",
"v11.11.02",
"v11.11.01",
"v11.11.00",
"v11.10.01",
"v11.10.00",
"v11.07.02-LTS",
"v11.07.00",
"v11.06.01",
"v11.06.00",
"v11.05.00",
"v11.04.00",
"v11.03.00",
"v11.02.00",
"v11.01.00",
"v11.00.00",
"v10.30.00",
"v10.29.00-b",
"v10.29.00",
"v10.28.00",
"v10.27.01",
"v10.27.00",
"v10.27.00-RC1",
"v10.26.00",
"v10.25.04",
"v10.25.03",
"v10.25.02-LTS",
"v10.25.02",
"v10.25.01b",
"v10.25.01",
"v10.25.00",
"v10.24.01",
"v10.24.00",
"v10.23.00",
"v10.22.00",
"v10.21.00",
"v10.20.05",
"v10.20.04",
"v10.20.03",
"v10.20.02",
"v10.20.01",
"v10.20.00",
"v10.09.01-LTS",
"v10.09.00-LTS",
"v10.08.00",
"v10.07.00-pre",
"v10.06",
"v10.05.00",
"v10.04.00",
"v10.03.00",
"v10.02.00",
"v09.43.02b",
"v09.43.02a",
"v09.43.02",
"v10.01.00",
"v10.00.00",
"v09.43.01",
"v09.43.00",
"v09.42.00",
"v09.41.00",
"v09.40.01",
"v09.40.00",
"v09.35.00",
"v09.33.00-RC4",
"v09.33.00",
"v09.33.00-RC3",
"v09.33.00-RC2",
"v09.33.00-RC1",
"v09.32.00-LTS-RC3",
"v09.32.00-LTS",
"v09.32.00-LTS-RC2",
"v09.32.00-LTS-RC1",
"v09.32.00-pre1",
"v09.32.00-LTS-RC",
"v09.31.00-pre1",
"v09.30.00",
"v09.23.00",
"v09.22.00",
"v09.21.00",
"v09.20.00",
"v09.14.00",
"2sxc-9.14.00",
"v09.14.00-Pre2",
"v09.14.00-Pre1",
"v09.13.00-pre2",
"v09.13.00-pre1",
"v09.13.00",
"v09.12.00",
"v09.11.01",
"v09.11.00",
"v09.10.00-pre2",
"v09.10.00-pre1",
"v09.10.00",
"v09.09.00-pre1",
"v09.09.00",
"v09.08.00",
"v09.07.00-B3",
"v09.07.00",
"v09.07.00-B2",
"v09.06.01-RC",
"v09.06.01",
"v09.06.01-pre3",
"v09.06.01-pre1",
"v09.06.00-pre5",
"v09.06.00",
"v09.06.00-pre4",
"v09.06.00-pre3",
"v09.06.00-pre2",
"v09.06.00-pre1",
"v09.05.02",
"v09.05.00",
"v09.02.00",
"v09.01.03",
"v09.01.01",
"v09.01.00",
"v09.00.02",
"v09.00.01",
"v09.00.00",
"v08.12.00",
"v08.11.00",
"v08.10.01",
"v08.10.00",
"v08.09.01",
"v08.09.00",
"v08.08.02",
"v08.08.01",
"v08.08.00",
"v08.07.00-RC2",
"v08.07.00",
"v08.07.00-RC1",
"v08.06.00-RC5",
"v08.06.00",
"v08.06.00-RC4",
"v08.06.00-RC3",
"v08.06.00-RC2",
"v08.06.00-RC1",
"v08.05.06b",
"v08.05.06",
"v08.05.05",
"v08.05.04",
"v08.05.03",
"v08.05.02",
"v08.05.01",
"v08.04.08",
"v08.04.08-p1",
"v08.04.05-02",
"v08.04.05-01",
"v08.04.05",
"v08.04.04",
"v08.04.04a",
"v08.04.03-nl",
"v08.04.03",
"v08.04.03a",
"v08.04.02",
"v08.04.01",
"v08.04.00j",
"v08.04.00-final",
"v08.04.00i",
"v08.04.00h",
"v08.04.00g",
"v08.04.00f",
"v08.04.00e",
"v08.04.00d",
"v08.04.00",
"v08.03.07",
"v08.03.06",
"v08.03.05",
"v08.03.03",
"v08.03.02",
"v08.03.01",
"v08.03.00-b",
"v08.03.00",
"v08.02.03-b",
"v08.02.03",
"v08.02.02",
"v08.02.01",
"v08.02.00",
"v08.01.02",
"v08.01.01",
"v08.01.00",
"v08.00.12",
"v08.00.11",
"v08.00.06",
"v08.00.03",
"v08.00.02",
"v08.00.01",
"v08.00.00",
"v07.03.04",
"v07.03.03",
"v07.03.02",
"v07.03.01",
"v07.03.00",
"v07.02.02",
"v07.02.00",
"v07.01.02",
"v07.01.01",
"v07.01.00",
"v07.00.02",
"v06.06.06",
"v06.06.05",
"v06.06.04",
"v06.06.02",
"v06.06.01",
"v06.06.00",
"v06.03.03",
"v06.03.02",
"v06.03-beta.01",
"v06.03.00",
"v06.02.00",
"v06.01.08",
"v06.01.07",
"v06.01.06",
"v06.01.05",
"v06.01.04",
"v06.01.03",
"v06.01.02",
"v06.01.01",
"v06.01.00",
"v06.00.06",
"v06.00.05",
"v06.00.04",
"06.00.03",
"06.00.02",
"05.05.02",
"05.05.01",
"05.05.00"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26885.json"
}
}
],
"modified": "2026-10-20T10:53:02.148280775Z",
"provider": "osv",
"references": [
"https://2SXC.org/en/blog/post/2sxc-security-notification-2021-001",
"https://github.com/2sic/2sxc/releases",
"https://burninatorsec.blogspot.com/2020/10/cve-2020-26885-xss-in-anchor-tags.html"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-26885",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 384153,
"published_at": "2021-06-07T04:15:07.953+00:00"
}