CVE-2020-29240

CVE-2020-29240 describes a persistent cross-site scripting (XSS) vulnerability in Lepton-CMS version 4.7.0. An authenticated attacker with administrative privileges can inject malicious script into the URL field, which then executes whenever an administrator navigates to the Menu-Pages-Pages Overview section. The vulnerability has a CVSS score of 4.8 (Medium), indicating a moderate severity. It requires high privileges (PR:H) and user interaction (UI:R) for exploitation, but the attack can be launched over the network (AV:N) with low complexity (AC:L), potentially leading to limited confidentiality and integrity impacts (C:L/I:L). While not listed on the CISA KEV catalog or showing active exploitation, a public exploit (EDB-49137) is available. There is minimal community discussion or media coverage surrounding this CVE, suggesting a low level of public awareness.