CVE-2024-48392

5.4 mediumEPSS 0.8%

Medium (5.4) in orangescrum orangescrum. EPSS 0.8% chance of exploitation in the next 30 days.

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-01-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

orangescrum:orangescrum

References

https://github.com/Renzusclarke/CVE-2024-48392-PoC
https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txt
https://www.orangescrum.com/
https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txt

Check your stack JSON