CVE-2024-45933

MediumCVSS 6.6

Published: 07/10/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) in the /admin/post/edit/ endpoint. Attackers can inject arbitrary JavaScript code via the Title and Summary fields, leading to arbitrary code execution in the victim's browser.

Risk Assessment

The risk includes potential session hijacking of administrators, data theft, or malware distribution within the organization through injected scripts in post content.

Recommendation

Immediately update OnlineNewsSite to the latest version, implement input validation and sanitization for the Title and Summary fields, and deploy Content Security Policy (CSP) headers.

Original NVD description (English source)

OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/post/edit/ endpoint.