CVE-2024-1257

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in Jspxcms 10.2.0. It has been classified as problematic. Affected is an unknown function of the file /ext/collect/find_text.do. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252996.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Jspxcms	10.2.0

References

https://github.com/sweatxi/BugHub/blob/main/find_text_do.pdfExploit
https://vuldb.com/?ctiid.252996Permissions Required
https://vuldb.com/?id.252996Third Party Advisory
https://github.com/sweatxi/BugHub/blob/main/find_text_do.pdfExploit
https://vuldb.com/?ctiid.252996Permissions Required
https://vuldb.com/?id.252996Third Party Advisory

Timeline

Published: Feb 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-125706.7An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from CVE-2024-125719.8The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.CVE-2024-125726.1The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. Thi CVE-2024-125745.4The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin CVE-2024-125755.3The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions CVE-2024-125765.5Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger a crash of the FW running on the GPU fr CVE-2024-125777.3Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's vi CVE-2024-125785.3The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5 CVE-2024-125795.3The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1 CVE-2024-12585.9A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown CVE-2024-125805.3A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, a CVE-2024-125814.8The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adm