CVE-2024-11348: Reflected XSS in Eura7 CMSmanager

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-27 · updated 2026-06-17
Weakness: CWE-79

Description

Eura7 CMSmanager in version 4.6 and below is vulnerable to Reflected XSS attacks through manipulation of return GET request parameter sent to a specific endpoint. The vulnerability has been fixed by a patche patch 17012022 addressing all affected versions in use.

Affected products

Eura7 CMSmanager: through 4.6

References

https://cert.pl/en/posts/2025/01/CVE-2024-11348

Get alerted when CVE-2024-11348 or the next vulnerability affects your stack