CVE-2024-2245 MEDIUM

CVE-2024-2245: Cross-Site Scripting vulnerability in moziloCMS

Vendor Mozilocms

Product moziloCMS

Weakness CWE-79 · XSS

Published March 7, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Cross-Site Scripting vulnerability in moziloCMS version 2.0. By sending a POST request to the '/install.php' endpoint, a JavaScript payload could be executed in the 'username' parameter.

Key dates

02Disclosure timeline

March 7, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-2245

Related vulnerabilities

04Related CVE

CVE-2024-34343 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt CVE-2023-4962 Video PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-0917 IBM Cognos Analytics cross-site scripting CVE-2024-11873 glomex oEmbed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-53941 Hollo renders posts received with form elements and allows submission