CVE-2024-25166 - Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter in the controller.php file

Back Back to CVE browser

MEDIUM

Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter in the controller.php file

Published Feb 27, 2024

6.1

MEDIUM

CVSS 3.1

EPSS 0.55%

Description

Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter in the controller.php file.

Affected products

Vendor Xiaocheng-Keji Product 71cms Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Xiaocheng-Keji

71cms

n/a

Version	Status	Constraints
1.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22504
Advisory
https://github.com/xiaocheng-keji/71cms/issues/1
Broken Link

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22504		Advisory
https://github.com/xiaocheng-keji/71cms/issues/1		Broken Link

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Feb 27, 2024

Updated Aug 29, 2024

Reserved Feb 7, 2024

Link CVE-2024-25166

CISA Vulnrichment

Updated Feb 27, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-25166

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-25166

ENISA EUVD

Assigner mitre

Published Feb 27, 2024

Updated Aug 29, 2024

Exploited since n/a

Link EUVD-2024-22504

EUVD-2024-22504