CVE-2024-11246

LOW

Farmacia 1.0 - Cross-Site Scripting via nome/cpf/dataNascimento Parameters

Title source: llm
STIX 2.1

Description

A vulnerability, which was classified as problematic, was found in code-projects Farmacia 1.0. Affected is an unknown function of the file /adicionar-cliente.php. The manipulation of the argument nome/cpf/dataNascimento leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions the parameter "nome" to be affected. But further inspection indicates that other parameters might be affected as well.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.284682
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.284682
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.443189
Product product
https://code-projects.org/

Scores

CVSS v3 3.5
EPSS 0.0051
EPSS Percentile 39.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
anisha/farmacia 1.0
Published Nov 15, 2024
Tracked Since Feb 18, 2026