PT-2025-50746 · Xmb Forum · Xmb Forum

Chokri Hammedi · Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58292

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions XMB Forum version 1.9.12.06

Description The software contains a persistent cross-site scripting issue. Authenticated administrators can inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in footer templates and news ticker fields, leading to script execution for all forum users when pages are rendered. The affected API endpoints include template modification pages and front page settings. The vulnerable parameters are the content fields within these templates, such as the footer template and news ticker field.

Recommendations Apply updates to address the issue. As a temporary workaround, restrict administrator access to template modification and front page settings. Sanitize all user-supplied input before rendering templates to prevent script injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-58292

Affected Products

Xmb Forum

References · 5

• 🔥 https://exploit-db.com/exploits/52044 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58292 · Security Note
• https://twitter.com/VulmonFeeds/status/1999311779541741715 · Twitter Post
• https://xmbforum2.com · Note
• https://vulncheck.com/advisories/xmb-forum-persistent-cross-site-scripting-via-admin-templates · Note