CVE-2024-33326

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-26 · updated 2026-06-17
Weakness: CWE-79

Description

A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the lumPageID parameter.

Affected products

Lumis Experience Platform: from 15.0.x through 16.1.x

References

http://seclists.org/fulldisclosure/2024/Jul/10
https://gist.github.com/rodnt/51ae2897abfff1bdcedccf72edbf3d24
http://seclists.org/fulldisclosure/2024/Jul/10
https://gist.github.com/rodnt/51ae2897abfff1bdcedccf72edbf3d24

Get alerted when CVE-2024-33326 or the next vulnerability affects your stack