CVE-2024-58285CWE-79cross-site-scripting

CVE-2024-58285

Medium · published December 11, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-11T03:16Z
Affected products (1)
ProductVersionsFixed in
chyrp/chyrpall versions—
References (5)
https://github.com/chyrp/ · [email protected]https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip · [email protected]https://www.exploit-db.com/exploits/52013 · [email protected]https://www.vulncheck.com/advisories/chyrp-stored-cross-site-scripting-vulnerability-via-post-title · [email protected]https://www.exploit-db.com/exploits/52013 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 DEC 21:15Z
    Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title
    cvelistv5