Persistent Cross-Site Scripting Vulnerability in XMB Forum by XMB
CVE-2024-58292

5.3MEDIUM

Key Information:

Vendor

Xmbforum2

Status
Xmb Forum
Vendor
CVE Published:
11 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-58292?

XMB Forum version 1.9.12.06 is vulnerable to a persistent cross-site scripting (XSS) issue that permits authenticated administrators to embed malicious JavaScript code into templates and front page settings. This exploitation enables attackers to insert XSS payloads into footer templates and news ticker fields, executing scripts for all users upon page rendering. This vulnerability poses a significant risk to users by potentially allowing an attacker to manipulate user sessions and steal sensitive information through crafted scripts.

Affected Version(s)

XMB Forum 1.9.12.06

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-58292 - Proof of Concept

References

https://www.exploit-db.com/exploits/52044
exploit
https://www.xmbforum2.com/
product
https://www.vulncheck.com/advisories/xmb-forum-persistent...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chokri Hammedi
JSON
.
CVE-2024-58292 : Persistent Cross-Site Scripting Vulnerability in XMB Forum by XMB