CVE-2024-58292

XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in footer templates and news ticker fields, enabling script execution for all forum users when pages are rendered.

CVSS v4.0

5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2025-12-11

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/52044

References

• CVE Record
• NVD entry

Related

• CVE-2024-58291
• CVE-2024-58293
• CVE-2024-58290
• CVE-2024-58294
• CVE-2024-5829
• CVE-2024-58295