CVE-2020-29593

CVE-2020-29593 describes a stored cross-site scripting (XSS) vulnerability in Orchard CMS versions prior to 1.10. An authenticated attacker with privileges to modify Media Settings can inject an XSS payload into the "Allowed File Types" list. This payload executes when a user attempts to upload a file type not permitted, causing the error message to display the malicious script. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity requiring low privileges and user interaction, potentially leading to limited confidentiality and integrity impacts. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.