CVE-2024-46878

Опубликовано: 23 мар. 2026

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier. This vulnerability allows attackers to execute arbitrary JavaScript code via a crafted payload, leading to potential access to sensitive information or unauthorized actions.

Ссылки

https://github.com/ColdFusionX/CVE-2024-46878-TikiCMS-XSS
Exploit
Third Party Advisory
https://tiki.org/article514-New-Security-Updates-Released-for-Tiki-27-x-LTS-26-x-and-24-x-LTS-and-Upgrade-is-Strongly-Recommended
Release Notes
https://tiki.org/tiki-newsletters.php?nlId=8&info=1
Product
https://github.com/ColdFusionX/CVE-2024-46878-TikiCMS-XSS
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tiki:tiki:*:*:*:*:*:*:*:*

Версия до 27.1 (исключая)

EPSS

Процентиль: 10%

0.00195

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVE-2024-46878

CVSS3: 5.4

debian

6 месяцев назад

A Cross-Site Scripting (XSS) vulnerability exists in the page paramete ...

GHSA-jvjc-r7p7-fpch

CVSS3: 5.4

github

6 месяцев назад

EPSS

Процентиль: 10%

0.00195

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79