CVE-2024-58292 MEDIUM

CVE-2024-58292: XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates

Vendor Xmbforum2
Product XMB Forum
Weakness CWE-79 · XSS
Published December 11, 2025
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in footer templates and news ticker fields, enabling script execution for all forum users when pages are rendered.

Key dates

02Disclosure timeline

December 11, 2025 CVE published
April 7, 2026 Record updated