CVE-2024-27558
MEDIUMCVSS 6.1/10EPSS 0.43%
Last modified
CVE-2024-27558 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.. EPSS estimates a 0.43% chance of exploitation in the next 30 days.
Description
Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Codelyfe | Stupid Simple Cms | <= 1.2.4 |
References
- https://github.com/kilooooo/cms/blob/main/2.mdExploit, Third Party Advisory
- https://github.com/kilooooo/cms/blob/main/2.mdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-27558?
Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.
How severe is CVE-2024-27558?
CVE-2024-27558 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.43% probability of exploitation in the next 30 days.
How do I fix CVE-2024-27558?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-2753Concrete CMS version 9 before 9.2.8 and previous versions pr…4.8
- CVE-2024-27530wasm3 139076a contains a Use-After-Free in ForEachModule.8.4
- CVE-2024-27532wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 0…7.5
- CVE-2024-27536Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2024-27537Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2024-2754A vulnerability classified as critical has been found in Sou…8.8
- CVE-2024-27559Stupid Simple CMS v1.2.4 was discovered to contain a Cross-S…6.3
- CVE-2024-2756Due to an incomplete fix to CVE-2022-31629 https://github.c…6.5
- CVE-2024-27561A Server-Side Request Forgery (SSRF) in the installUpdateThe…8.1
- CVE-2024-27563A Server-Side Request Forgery (SSRF) in the getFileFromRepo …5.3
- CVE-2024-27564pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc…6.5
- CVE-2024-27565A Server-Side Request Forgery (SSRF) in weixin.php of ChatGP…9.8
Are you affected by CVE-2024-27558?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST