CVE-2020-37014 - CVE House
Back to Database
Status published Medium CVE-2020-37014

Tryton 5.4 - Persistent Cross-Site Scripting

Vulnerability Description

Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-37014

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Benjamin Kunz Mejri

References

More from Tryton

View All →
CVE-2025-66424
Tryton trytond 6.0 before 7.6.11 does not enforce access rights...
Medium 6.5
CVE-2025-66423
Tryton trytond 6.0 before 7.6.11 does not enforce access rights...
High 7.1
CVE-2025-66422
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive...
Medium 4.3
CVE-2025-66421
Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it...
Medium 5.4
CVE-2025-66420
Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an...
Medium 5.4

Affected Vendor

Affected Software

Tryton
Vulnerable Versions:
0

Timeline

Official Publish: January 30th, 2026
Last Modified: May 14th, 2026
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact