CVE-2020-12707

LeptonCMS 4.5.0 contains an XSS flaw in modules/wysiwyg/save.php. The only mitigation is stripping SCRIPT elements, enabling attackers to inject JavaScript via HTML event handlers instead of script tags. Multiple connected sources (Red Hat advisory, CNVD, CNVD-2020-35505, OSV, CVE record, and Exp...