Vulnerability · Published Oct 29, 2024 · Assigned by GitHub_M
CVE-2024-50348InstantCMS has a Cross Site Scripting Vulnerability
Medium 5.4
In plain English
A medium-severity cross-site scripting in icms2 from instantsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| instantsoft | icms2 | < 2.16.3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N