CVE-2024-32890

The CVE-2024-32890 entry describes a stored cross-site scripting (XSS) in LibreSpeed speedtest. Affected are LibreSpeed speedtest instances running version 5.2.5 or higher with telemetry enabled. The vulnerability arises from missing neutralization in the ispinfo.processedString field of the tele...

CVE-2024-32890 Stored Cross-site Scripting in results JSON API in librespeed/speedtest

librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information in a speedtest result leads to stored Cross-site scripting in the JSON API. The processedString field in the ispinfo parameter is missing neutralization. It...

PT-2024-24943 · Unknown · Librespeed Speedtest

Name of the Vulnerable Software and Affected Versions: librespeed/speedtest versions 5.2.5 through 5.3.0 Description: The issue arises from missing neutralization of the ISP information in a speedtest result, leading to stored Cross-site scripting in the JSON API. The processedString field in the...