CVE-2024-10087 | THREATINT

Description

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might craft a link containing a malicious script, which then gets directly embedded in references to other resources, what causes the script to run in user's context multiple times. This vulnerability has been patched in version 79.0

Reserved 2024-10-17 | Published 2025-04-14 | Updated 2025-04-14 | Assigner CERT-PL

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

Any version before 79.0

affected

Credits

Paweł Zdunek (Afine Team) finder

References

cert.pl/en/posts/2025/04/CVE-2024-10087 third-party-advisory

www.iksoris.pl/...ezerwacji-i-sprzedazy-biletow-iksoris.html product

cve.org (CVE-2024-10087)

nvd.nist.gov (CVE-2024-10087)

Download JSON