CVE-2024-42697

2024-09-2000:00:00

mitre

github.com

cross site scripting

leotheme leo product search module

remote attacker

arbitrary code

q parameter

EPSS

Percentile

9.6%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:leotheme:leo_product_search_module:*:*:*:*:*:*:*:*"
    ],
    "vendor": "leotheme",
    "product": "leo_product_search_module",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "2.1.6"
      }
    ],
    "defaultStatus": "unknown"
  }
]