6.1med
CVE-2024-28126
Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00.
Published 2 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 24%
Public exploits
0
none known
Summary
Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using 0ch BBS Script ver.4.00.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.31% probability of exploitation in the next 30 days, higher than 24% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected products
- Zerochannel 0ch BBS Script
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- jvn.jp /en/jp/JVN46874970/ · x_transferred
Sources
- CVE List: CVE-2024-28126
- NVD: CVE-2024-28126
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.