CVE-2024-22927

MEDIUMNuclei

eyoucms eyoucms Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2024-22927 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 21, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 2, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

eyoucms

Browse eyoucms / eyoucms
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMeyoucms v.1.6.5 - Cross-Site ScriptingCVSS 6.1

Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

Impact

Allows attackers to execute malicious scripts on the victim's browser.

Remediation

Upgrade eyoucms to version 1.6.6 or later to fix the XSS vulnerability.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscve2024cveeyoucmscmsxssvulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:eyoucms:eyoucms:1.6.5:*:*:*:*:*:*:*
FOFA: title="eyoucms"
https://github.com/weng-xianhu/eyoucms/issues/57 https://nvd.nist.gov/vuln/detail/CVE-2024-22927

Source: ProjectDiscovery

References

2