CVE-2024-48392

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting XSS. An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover...

CVE-2024-48392

creationtimestamp| type| source ---|---|--- 2025-01-21 21:15:46+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgbrkp7vlm2f 2025-01-22 21:02:00+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lgebayyrpe24 2025-01-22 22:02:24+00:00|...

CVE-2024-48392

OrangeScrum version v2.0.11 is vulnerable to a Cross-Site Scripting (XSS) flaw in both its self-hosted and premium versions. The root cause is a lack of effective filtering, escaping, and input validation of user-supplied data, specifically within the user email functionality. An attacker can exp...