CVE-2024-32206

A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata parameter.

CVSS v3.1

4.6 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 32th percentile

Published

2024-04-19

Updated

2026-07-09

Proof-of-concept exploits (1)

• majic-banana/vulnerability/blob/main/POC/WUZHICMS4.1.0%20Stored%20Xss%20In%20Affiche%20Mo…

References

• CVE Record
• NVD entry

Related

• CVE-2024-31008
• CVE-2024-33350
• CVE-2024-48270
• CVE-2024-3218
• CVE-2024-3221
• CVE-2024-3217