CVE Catalog
CVE-2024-37856
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0.30%
22th percentile - higher than 22% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, and middle name fields on the User Profile page.
Risk Assessment
An attacker can inject a malicious script that executes in the administrator's browser, leading to session theft, data modification, or full system compromise.
Recommendation
Update the system to the latest version and implement input validation and output encoding (e.g., HTML encoding) for all user profile form fields.
Original NVD description (English source)
Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, middle name fields in the User Profile page.