CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-48392: OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of...
Description
OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.
Classification
CVE ID: CVE-2024-48392
Affected Products
Vendor: n/a
Product: n/a
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 17.98% (scored less or equal to compared to others)
EPSS Date: 2025-02-19 (when was this score calculated)
References
https://www.orangescrum.com/https://github.com/Renzusclarke/CVE-2024-48392-PoC
https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txt