CVE-2024-37392

MEDIUM

SMSEagle < 6.0 - Stored Cross-Site Scripting in SMS Inbox

Title source: llm

Description

A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SMS message, which gets executed when the SMS is viewed and specially interacted in web-GUI.

References (1)

Core 1

Core References

Various Sources

https://www.smseagle.eu/security-advisory/resolved-xss-in-smseagle-software-cve-2024-37392/

Scores

CVSS v3 6.1

EPSS 0.0024

EPSS Percentile 15.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

smseagle/smseagle < 6.0

Published Aug 23, 2024

Tracked Since Feb 18, 2026