CVE-2024-50861

6.1 mediumEPSS 0.8%

Medium (6.1) in gestioip gestioip. EPSS 0.8% chance of exploitation in the next 30 days.

The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-01-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gestioip:gestioip

References

http://www.gestioip.net
https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861
https://github.com/muebel/gestioip-docker-compose
https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861

Check your stack JSON