Vulnerability record/PUBLISHED/Published Oct 29, 2024 22:25:19 UTC

CVE-2024-50348

InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3.

Base score5.4/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredLowPR

User interactionRequiredUI

ScopeChangedS

Confidentiality impactLowC

Integrity impactLowI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityGitHub_M

Last updatedOct 30, 2024 13:13:20 UTC

PublishedOct 29, 2024 22:25:19 UTC

ReservedOct 22, 2024 17:54:40 UTC