CVE-2024-10288

CVE-2024-10288 concerns LocalServer 1.0.9 with a Cross-Site Scripting (XSS) vulnerability that allows a remote attacker to craft a query to an authenticated user and potentially steal session details via the /mlss/SubscribeToList endpoint, specifically the ListName parameter. The connected docume...

CVE-2024-10287

CVE-2024-10287 describes a Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9. A remote attacker can craft a query to an authenticated user via the /mlss/ForgotPassword endpoint, abusing the ListName parameter to steal session details. The CVSS v3.1 base score is 6.1 (Medium), w...

CVE-2024-10289

This CVE affects LocalServer 1.0.9 and involves a Cross-Site Scripting (XSS) flaw in the /mlss/ManageSubscription endpoint, specifically exploiting the MSubListName parameter to potentially steal session details from authenticated users. The connected PT-2024-16161 entry confirms the vulnerabilit...

CVE-2024-10286

LocalServer 1.0.9 is affected by a cross-site scripting (XSS) vulnerability that can be exploited by a remote attacker via a crafted request to /testmail/index.php (vulnerable parameter) to steal session details from an authenticated user. The issue stems from improper input handling in the affec...