VULNERABILITY INTELLIGENCE

CVE-2024-5521

CVSS score6.4 MEDIUM
EPSS probability0.26%
CISA KEVNot currently listed
Published2024-05-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Description

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user having the roles of gallery editor or VFS resource manager will have the permission to upload images in the .svg format containing JavaScript code. The code will be executed the moment another user accesses the image.

Weakness classification

  • cve-coordination@incibe.es: CWE-79
  • nvd@nist.gov: CWE-79

Primary references