← Vulnerability feed

Vulnerability record · CVE-2020-26280 · published 18 December 2020

CVE-2020-26280: Openslides cross-site scripting vulnerability

Openslides · Openslides

OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In the web applications users can enter rich text in various places, e.g. for personal notes or in motions. These fields can be used to store arbitrary JavaScript Code that will be executed when other users read the respective text. An attacker could utilize this vulnerability be used to manipulate votes of other users, hijack the moderators session or simply disturb the meeting. The vulnerability was introduced with 6eae497abeab234418dfbd9d299e831eff86ed45 on 16.04.2020, which is first included in the 3.2 release. It has been patched in version 3.3 ( in commit f3809fc8a97ee305d721662a75f788f9e9d21938, merged in master on 20.11.2020).

8.9 CVSS 3.1 High EPSS 1.4% · top 29.3% CWE-79 · Cross-site scripting
8.9CVSS 3.1 base score, v2 3.5
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In the web applications users can enter rich text in various places, e.g. for personal notes or in motions. These fields can be used to store arbitrary JavaScript Code that will be executed when other users read the respective text. An attacker could utilize this vulnerability be used to manipulate votes of other users, hijack the moderators session or simply disturb the meeting. The vulnerability was introduced with 6eae497abeab234418dfbd9d299e831eff86ed45 on 16.04.2020, which is first included in the 3.2 release. It has been patched in version 3.3 ( in commit f3809fc8a97ee305d721662a75f788f9e9d21938, merged in master on 20.11.2020).

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/OpenSlides/OpenSlides/blob/master/CHANGELOG.rst#version-33-2020-12-18 Release NotesThird Party Advisory
https://github.com/OpenSlides/OpenSlides/commit/f3809fc8a97ee305d721662a75f788f9e9d21938 PatchThird Party Advisory
https://github.com/OpenSlides/OpenSlides/pull/5714 PatchThird Party Advisory
https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-w5wr-98qm-jx92 Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-043.txt Broken Link
https://github.com/OpenSlides/OpenSlides/blob/master/CHANGELOG.rst#version-33-2020-12-18 Release NotesThird Party Advisory
https://github.com/OpenSlides/OpenSlides/commit/f3809fc8a97ee305d721662a75f788f9e9d21938 PatchThird Party Advisory
https://github.com/OpenSlides/OpenSlides/pull/5714 PatchThird Party Advisory
https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-w5wr-98qm-jx92 Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-043.txt Broken Link

Track CVE-2020-26280 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-25519Openslides improper access control vulnerabilityOpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to v…EPSS 0.68%7.5CVE-2024-22892Openslides inadequate encryption strength vulnerabilityOpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.EPSS 0.25%7.5CVE-2024-22893Openslides improper privilege management vulnerabilityOpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain…EPSS 0.36%6.5CVE-2025-30343Openslides path traversal vulnerabilityA directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The int…EPSS 0.47%6.1CVE-2025-30342Openslides cross-site scripting vulnerabilityAn XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown tha…EPSS 0.26%4.1CVE-2025-30345Openslides cross-site scripting vulnerabilityAn issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of…EPSS 0.28%3.7CVE-2025-30344Openslides observable discrepancy vulnerabilityAn issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on…EPSS 0.32%6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed

Source: NIST National Vulnerability Database (record CVE-2020-26280), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.