CVE-2024-58292CWE-79cross-site-scripting

CVE-2024-58292

published December 12, 2025

CVSS
5.3
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in footer templates and news ticker fields, enabling script execution for all forum users when pages are rendered.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-12T03:15Z
References (3)
https://www.exploit-db.com/exploits/52044 · [email protected]https://www.vulncheck.com/advisories/xmb-forum-persistent-cross-site-scripting-via-admin-templates · [email protected]https://www.xmbforum2.com/ · [email protected]
EPSS history
Timeline
  • 11 DEC 21:35Z
    XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates
    cvelistv5