What is CVE-2024-48228?

CVE-2024-48228 is a medium-severity vulnerability in Funadmin, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2024-10-25.

How severe is CVE-2024-48228?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Funadmin

CVE-2024-48228

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (18.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Funadmin — versions 5.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Exploit, Issue Tracking)

Frequently asked questions

What is CVE-2024-48228?: CVE-2024-48228 is a medium-severity vulnerability in Funadmin, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2024-10-25.
How severe is CVE-2024-48228?: Medium severity. CVSS v3 base score is 6.1 out of 10.