CVE-2024-50861 EXPLOIT
6.1
MEDIUM · CVSS 3.1 · EPSS 0.8% (pctl 56)
Patch early
A public exploit exists.
Description
The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.
Scoring
| CVSS | 6.1 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 0.81% — more likely to be exploited than 56% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2025-01-14 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| gestioip | gestioip |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | GestioIP 3.5.7 - Stored Cross-Site Scripting (Stored XSS) | 2025-04-14 |
References
→ the Explorer · watch your stack · NVD