Cross-Site Scripting Vulnerability in Shenzhen Landray Software's EKP
CVE-2024-48068

6.1MEDIUM

Key Information:

Vendor

Shenzhen Landray Software Co., LTD

Vendor
CVE Published:
15 November 2024

What is CVE-2024-48068?

A cross-site scripting (XSS) vulnerability exists in the Landray EKP application developed by Shenzhen Landray Software Co., LTD. This security flaw enables attackers to inject arbitrary web scripts or HTML through specially crafted payloads, potentially leading to unauthorized access and manipulation of user data. The vulnerability is present in version 16 and earlier, emphasizing the need for users to ensure their applications are properly secured against such exploits.

References

https://gist.github.com/CoinIsMoney/3448ba7c3e0cf01c3cbc6...
https://www.landray.com.cn/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.