CVE-2024-50348CWE-79

InstantCMS has a Cross Site Scripting Vulnerability

Medium · published October 29, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
27.3
In the wild
Unconfirmed
What it is

InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-10-29T22:25Z
EPSS history
Timeline
  • 29 OCT 22:25Z
    InstantCMS has a Cross Site Scripting Vulnerability
    cvelistv5