CVE-2024-37675
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the "sectionContent" parameter in the functionality of adding notes to an uploaded file.
Risk Assessment
An attacker can inject a malicious script that executes in another user's browser, potentially leading to session hijacking, data leakage, or account takeover.
Recommendation
Immediately update Tessi Docubase to the latest version and apply input filtering and validation for the "sectionContent" parameter.
Original NVD description (English source)
Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the parameter "sectionContent" related to the functionality of adding notes to an uploaded file.