CVE-2020-15869Medium· 5.4▾ SunlitSonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).
nexus_repository_manager < 3.25.1Upgrade past the affected range:
nexus_repository_manager 3.25.1Connected by shared product, vendor, weakness, or advisory.
CVE-2020-15870Medium· 6.1Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).
CVE-2020-15871High· 8.8Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.
CVE-2026-7308Medium· 5.4An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus …
CVE-2026-17596Medium· 6.1Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS)
CVE-2026-3438Medium· 6.1A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially craft…
CVE-2021-40143High· 8.2Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection