CVE-2024-10087: XSS in iKSORIS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-14 · updated 2026-06-17
Weakness: CWE-79

Description

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might craft a link containing a malicious script, which then gets directly embedded in references to other resources, what causes the script to run in user's context multiple times. This vulnerability has been patched in version 79.0

Affected products

SoftCOM iKSORIS: before 79.0 — fixed in 79.0

How to fix

Upgrade to a fixed version: SoftCOM iKSORIS 79.0. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2025/04/CVE-2024-10087
https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html

Get alerted when CVE-2024-10087 or the next vulnerability affects your stack