CVE-2024-50348 MEDIUM

CVE-2024-50348: InstantCMS has a Cross Site Scripting Vulnerability

Vendor Instantsoft

Product icms2

Weakness CWE-79 · XSS

Published October 29, 2024

Last update October 30, 2024

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3.

Key dates

02Disclosure timeline

October 29, 2024 CVE published

October 30, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-50348 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-1320 Cross-site Scripting (XSS) - Stored in osticket/osticket CVE-2023-45073 WordPress Mendeley Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) CVE-2026-4576 code-projects Exam Form Submission update_s5.php cross site scripting CVE-2024-29790 WordPress Squirrly SEO plugin <= 12.3.16 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-13678 Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes