CVE-2024-28097 HIGH

CVE-2024-28097: Stored Cross-site Scripting in Calendar functionality in Schoolbox

Vendor Schoolbox Pty Ltd

Product Schoolbox

Weakness CWE-79 · XSS

Published March 7, 2024

Last update August 26, 2024

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Calendar functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users.

Key dates

02Disclosure timeline

March 7, 2024 CVE published

August 26, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-28097 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-67710 Stored XSS vulnerability in ArcGIS Server CVE-2024-25599 WordPress Seriously Simple Podcasting plugin <= 3.0.2 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2021-24259 Elementor Addon Elements < 1.11.2 - Contributor+ Stored XSS CVE-2025-23518 WordPress GoogleMapper plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability CVE-2024-11894 The Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting