CVE-2024-37859

MediumCVSS 6.1

Published: 29/07/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the 'page' parameter in php-lfis/admin/index.php.

Risk Assessment

An attacker can exploit this flaw to inject malicious scripts in the context of an admin session, potentially leading to data theft, account takeover, or further privilege escalation within the system.

Recommendation

Immediately update Lost and Found Information System to the latest patched version and implement input validation and sanitization for the 'page' parameter.

Original NVD description (English source)

Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php.