CVE-2024-24397

MediumCVSS 5.4

Published: 05/02/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.75%

51th percentile - higher than 51% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the ReportName field.

Risk Assessment

An attacker can exploit this vulnerability to steal user sessions, take over accounts, or spread malware within the organization.

Recommendation

Immediately update Stimulsoft Dashboard.JS to version 2024.1.2 or later and apply input filtering on the ReportName field.

Original NVD description (English source)

Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field.