Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Simpul Events allows stored web code injection

CVE-2024-51867 · published 1 year ago
Summary

Versions of Simpul Events up to 1.8.5 let an attacker place malicious script into pages that other users view. When the page loads, the script runs in the visitor’s browser, potentially stealing information or taking actions as that user. Update to the latest version or apply the vendor’s patch and ensure input is properly filtered to prevent this risk.

Original advisory text
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geilt Simpul Events by Esotech simpul-events-by-esotech allows Stored XSS.This issue affects Si...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geilt Simpul Events by Esotech simpul-events-by-esotech allows Stored XSS.This issue affects Simpul Events by Esotech: from n/a through <= 1.8.5.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published19 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-51867 · NVD
Track software like this
Free during beta