CVE-2024-5405CWE-79

Multiple vulnerabilities in WinNMP from Wtriple

Medium · published May 27, 2024

CVSS v3.1
6.3
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-27T11:50Z
EPSS history
Timeline
  • 27 MAY 11:50Z
    Multiple vulnerabilities in WinNMP from Wtriple
    cvelistv5