High severity7.5NVD Advisory· Published May 20, 2021· Updated Jun 17, 2026
CVE-2020-18220
CVE-2020-18220
Description
Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.
Affected products
3- DoraCMS/DoraCMSdescription
Patches
Vulnerability mechanics
References
1- github.com/doramart/DoraCMS/issues/190nvdExploitIssue TrackingThird Party Advisory
News mentions
0No linked articles in our index yet.