Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Upload Scanner allows attackers to inject malicious code

CVE-2024-56035 · published 1 year ago
Summary

Upload Scanner versions up to 1.2 can display data that was sent to it without cleaning it first. An attacker could send a specially crafted link that, when a user clicks it, makes unwanted code run in the user's web browser, potentially stealing information or changing what the user sees. Update the product to the newest version or apply the vendor's fix, and avoid letting untrusted users provide input to the scanner.

Original advisory text
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kurt Payne Upload Scanner upload-scanner allows Reflected XSS.This issue affects Upload Scanner...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kurt Payne Upload Scanner upload-scanner allows Reflected XSS.This issue affects Upload Scanner: from n/a through <= 1.2.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Jan 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-56035 · NVD
Track software like this
Free during beta