CVE-2024-33975: Cross-site Scripting in Janobe E-Negosyo System

Published Aug 6, 2024

Updated

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'view' parameter in '/admin/products/index.php'.

Affected Software

1 affected component

Janobe Young Entrepreneur E-negosyo System=1.0

Remediation

Information

There is no reported solution at this time.

Event History

Aug 6, 2024

CVE Published

via MITRE·10:54 AM

Data Sourced

via MITRE·10:54 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-33975?

CVE-2024-33975 is categorized as a medium severity Cross-Site Scripting (XSS) vulnerability.

How do I fix CVE-2024-33975?

To fix CVE-2024-33975, you should update the E-Negosyo System to a version that addresses this vulnerability.

Who is affected by CVE-2024-33975?

CVE-2024-33975 affects users of the Janobe Young Entrepreneur E-Negosyo System version 1.0.

What does CVE-2024-33975 allow an attacker to do?

CVE-2024-33975 allows an attacker to execute arbitrary JavaScript on the victim's browser by exploiting the 'view' parameter.

Is authentication required to exploit CVE-2024-33975?

Yes, CVE-2024-33975 requires the attacker to send a payload to an authenticated user.