LiveActive security incident?Get immediate response
CVE Record

CVE-2020-24026: TinyShop, a free and open source mall based on RageFrame2, has a stored XSS vulnerability that affects vers...

TinyShop, a free and open source mall based on RageFrame2, has a stored XSS vulnerability that affects version 1.2.0. TinyShop allows XSS via the explain_first and again_explain parameters of the /evaluate/index.php page. The vulnerability may be exploited remotely, resulting in cross-site scripting (XSS) or information disclosure.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

TinyShop 1.2.0 can store unsafe content in evaluation explanation fields. When another user or administrator later views that content, their browser may run attacker-controlled script. That can expose session data or sensitive page information, depending on how the site is configured.

Executive priority

Treat this as a targeted web application risk, not a broad infrastructure emergency. Prioritize if TinyShop 1.2.0 is internet-facing, handles customer accounts, or exposes administrator sessions through evaluation pages.

Technical view

CVE-2020-24026 describes stored XSS in TinyShop 1.2.0, a RageFrame2-based open source mall. The reported inputs are explain_first and again_explain on /evaluate/index.php. The CVE states remote exploitation may result in cross-site scripting or information disclosure. No CVSS, CWE, CPE, patch, or mitigation details are provided.

Likely exposure

Exposure appears limited to deployments of TinyShop version 1.2.0 using the affected evaluation workflow. The provided CVE metadata does not identify CPEs, downstream packages, hosting defaults, or affected forks beyond the referenced TinyShop materials.

Exploitation context

The source bundle does not show CISA KEV listing or other evidence of active exploitation. The issue is remotely reachable in principle because the vulnerable parameters are part of a web page, but the available sources do not establish authentication requirements or real-world exploitation.

Researcher notes

Evidence is sparse: the CVE record names parameters and version but lacks CVSS, CWE, affected CPEs, authentication context, patch status, and exploit confirmation. Validate against the GitHub issue and local code before assigning organizational severity.

Mitigation direction

  • Identify whether TinyShop 1.2.0 is deployed or embedded in any customer-facing shop.
  • Check the TinyShop repository and issue thread for vendor remediation guidance.
  • If no supported fix exists, restrict public access to the affected evaluation workflow.
  • Sanitize and output-encode evaluation explanation fields in maintained forks.
  • Review stored evaluation content for suspicious script-like markup.

Validation and detection

  • Confirm the running TinyShop version and code origin against the referenced repository.
  • Review /evaluate/index.php handling of explain_first and again_explain.
  • Use an authorized safe marker test to verify stored output is encoded, not executed.
  • Check logs and database records for unexpected HTML or script-like content in evaluation fields.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-24026 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.