CVE-2024-45699CWE-79

Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps

High · published April 2, 2025

CVSS v4.0
7.5
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-04-02T06:12Z
EPSS history
Timeline
  • 02 APR 06:12Z
    Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps
    cvelistv5