VULNERABILITY INTELLIGENCE

CVE-2024-48392

CVSS score5.4 MEDIUM
EPSS probability0.83%
CISA KEVNot currently listed
Published2025-01-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.

Weakness classification

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references