CVE-2024-57277

MEDIUM

InnoShop <= 0.3.8 - Stored Cross-Site Scripting via SVG File Upload

Title source: llm

InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.

Core 4

Core References

Various Sources

Various Sources

Patch

Issue Tracking

CVSS v3 5.7

EPSS 0.0045

EPSS Percentile 36.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-79

Status published

Published Jan 24, 2025

Tracked Since Feb 18, 2026