Lucene search

[email protected]NVD:CVE-2024-35351

HistoryMay 30, 2024 - 5:15 p.m.

CVE-2024-35351

2024-05-3017:15:33

CWE-79

[email protected]

web.nvd.nist.gov

vulnerability

diño physics school assistant

cross-site scripting

systemsettings

update settings

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

A vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the file /classes/SystemSettings.php?f=update_settings. Manipulating the parameter name results in cross-site scripting.

References

vuln.pentester.stream/pentester-vulnerability-research/post/2298534/vuln2-execution-after-redirect-ear-stored-cross-site-scripting-xss

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

Related for NVD:CVE-2024-35351

cve1 cvelist1 vulnrichment1