CVE-2024-11175

Public CMS Voting Management save cross site scripting

State: Published
Severity: 5.3 Medium
Published: Nov 13, 2024
Updated: Nov 13, 2024
Reserved: Nov 13, 2024

Description

A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
CMSPublic	5.202406.dAffected

References

VDB-284351 | Public CMS Voting Management save cross site scriptingvdb-entry
VDB-284351 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
https://gitee.com/sanluan/PublicCMS/issues/IB2BUVexploitissue-tracking
https://gitee.com/sanluan/PublicCMS/commit/b9530b9cc1f5cfdad4b637874f59029a6283a65cbroken-linkpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.