CVE-2024-12980 MEDIUM

CVE-2024-12980: code-projects Job Recruitment _all_edits.php fln_update cross site scripting

Vendor Code-Projects

Product Job Recruitment

Weakness CWE-79 · XSS

Published December 27, 2024

Last update December 27, 2024

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. Affected is the function fln_update of the file /_parse/_all_edits.php. The manipulation of the argument fname/lname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

December 27, 2024 CVE published

December 27, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-12980 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2022-0701 SEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site Scripting CVE-2024-47347 WordPress Chartify plugin <= 2.7.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-3997 Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute CVE-2024-26030 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-22317 WordPress Gallery Images Ape plugin <= 2.2.8 - Reflected Cross Site Scripting (XSS) vulnerability