CVE-2024-48246

MEDIUM

Vehicle Management System 1.0 - Stored Cross-Site Scripting via Name Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-48246. PoCs published by ShadowByte1.

AI-analyzed exploit summary This repository provides a detailed writeup for CVE-2024-48246, a stored XSS vulnerability in Vehicle Management System 1.0. It describes the vulnerability, affected parameters, attack vectors, and mitigation strategies without including executable exploit code.

Description

Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/booking.php.

Exploits (1)

nomisec WRITEUP 1 stars
by ShadowByte1 · poc
https://github.com/ShadowByte1/CVE-2024-48246

This repository provides a detailed writeup for CVE-2024-48246, a stored XSS vulnerability in Vehicle Management System 1.0. It describes the vulnerability, affected parameters, attack vectors, and mitigation strategies without including executable exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Vehicle Management System 1.0
No auth needed
Prerequisites: Access to the booking form at /vehicle-management/booking.php · Admin interaction to view the booking list at /vehicle-management/bookinglist.php
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Mitigation, Third Party Advisory
https://github.com/ShadowByte1/CVE-2024-48246

Scores

CVSS v3 5.4
EPSS 0.0039
EPSS Percentile 30.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
janobe/vehicle_management_system 1.0
Published Mar 05, 2025
Tracked Since Feb 18, 2026