Vulnerability · Published Apr 14, 2025 · Assigned by CERT-PL

CVE-2024-10087XSS in iKSORIS

Medium 5.3

In plain English

A medium-severity cross-site scripting in iKSORIS from SoftCOM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.2%top 84.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might craft a link containing a malicious script, which then gets directly embedded in references to other resources, what causes the script to run in user's context multiple times. This vulnerability has been patched in version 79.0

Affected products (as reported)

Vendor	Product	Versions
SoftCOM	iKSORIS	0 – before 79.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://cert.pl/en/posts/2025/04/CVE-2024-10087 third-party-advisory
https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html product