VULNERABILITY INTELLIGENCE

CVE-2024-25807

CVSS score6.1 MEDIUM

EPSS probability0.46%

CISA KEVNot currently listed

Published2024-03-22

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.

Weakness classification

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references

cve@mitre.org — Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory