PT-2025-3177 · Unknown · Dreamwinner Easy Language Switcher

João Pedro S Alcântara

·

Published

2025-01-02

·

Updated

2025-01-07

·

CVE-2024-56029

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions Dreamwinner Easy Language Switcher versions n/a through 1.0
Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can inject malicious scripts into a website, potentially stealing user data or taking control of the user's session.
Recommendations For versions n/a through 1.0, consider disabling the vulnerable component until a patch is available. Restrict access to the affected module to minimize the risk of exploitation. Avoid using parameters that may be vulnerable in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56029

Affected Products

Dreamwinner Easy Language Switcher