CVE-2024-33985
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/course/index.php'.
- Score
- CVSS 3.1 7.1 High
- Status
- Analyzed - cve-coordination@incibe.es
- Published
- 2024-08-06
- Last modified
- 2024-08-06
- Weaknesses
- CWE-79
Affected products
- School Attendance Monitoring System (Janobe)
- School Attendence Monitoring System (Janobe)
- School Event Management System (Janobe)
References
- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
