---
id: CVE-2020-28727
title: >-
  Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter
  to views/bootstrap/class.DropFolderChooser.php.
summary: >-
  Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter
  to views/bootstrap/class.DropFolderChooser.php.
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: seeddms
product: seeddms
affected:
  - seeddms = 6.0.13
published: '2020-12-07'
updated: '2026-07-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-28727'
references:
  - url: >-
      https://sourceforge.net/p/seeddms/code/ci/32b03b1e5880e2f38cecf4ac7743f8f62f33043f/
    label: cve@mitre.org
  - url: 'https://sourceforge.net/projects/seeddms/files/'
    label: cve@mitre.org
  - url: 'http://seeddms.com'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://sourceforge.net/p/seeddms/code/ci/32b03b1e5880e2f38cecf4ac7743f8f62f33043f/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://sourceforge.net/projects/seeddms/files/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00705
epssPercentile: 0.51322
ingestedAt: '2026-07-05T02:00:01.335Z'
---

## Overview

Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.

## Affected

- `seeddms = 6.0.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.