CVE-2020-13564: phpGACL template acl_id parameter reflected XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable with no authentication and has a very high EPSS score with public exploit detail, though it requires user interaction and is not in KEV.

What it is

phpGACL 3.3.7 contains a cross-site scripting flaw in its template functionality, where the acl_id parameter is not properly neutralized before being returned in an HTTP response. A crafted URL can cause arbitrary JavaScript to execute in the victim's browser, which matters because phpGACL is embedded in applications such as OpenEMR that handle clinical data.

Impact

An attacker can execute arbitrary JavaScript in the context of a victim's session, enabling theft of session cookies or other sensitive data and actions performed as the victim. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network via a crafted URL containing the acl_id parameter; no authentication is required (PR:N), but the victim must be induced to load the link (UI:R).

Exploitation

Not listed in CISA KEV, but EPSS is 0.75856 (99.5th percentile) and the only references are Talos advisories tagged Exploit, indicating public exploit detail exists though no in-the-wild activity is confirmed.

What to do

• Upgrade phpGACL to a version that fixes the template acl_id XSS, or apply the vendor patch referenced by the Talos advisory.
• If phpGACL is bundled in OpenEMR or another application, update that application to a release containing the fixed library.
• Encode or validate the acl_id parameter on output and reject unexpected characters at the template layer.
• Deploy a WAF rule or input filter that blocks script content in the acl_id parameter as a temporary compensating control.

Detection

• Search web and proxy logs for requests to phpGACL template endpoints with script-like payloads in the acl_id parameter.
• Monitor for reflected script content in responses from phpGACL template pages.
• Alert on outbound requests or cookie access patterns consistent with XSS payload execution from application pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.