CVE-2024-32206

MediumCVSS 4.6

Published: 19/04/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

In WUZHICMS v4.1.0, a stored XSS vulnerability exists in the /affiche/admin/index.php component. Attackers can inject arbitrary scripts or HTML via the $formdata parameter.

Risk Assessment

The risk involves arbitrary JavaScript execution in admin browsers, potentially leading to session theft, defacement, or data theft.

Recommendation

Immediately update WUZHICMS to the latest version and apply input filtering and encoding on the $formdata parameter.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata parameter.