CVE-2024-49706

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the target parameter sent in a POST request to one of the endpoints. This vulnerability has been patched in version 79.0

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
SoftCOM	iKSORIS	< 79.0

References

https://cert.pl/en/posts/2025/04/CVE-2024-10087Third Party Advisory
https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.htmlProduct

Timeline

Published: Apr 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-497076.1Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might tr CVE-2024-497085.4Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick CVE-2024-497094.4Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to CVE-2024-49715.4The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all ver CVE-2024-497147.8In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device e CVE-2024-49729.8A vulnerability classified as critical has been found in code-projects Simple Chat System 1.0. This affects an unknown part of the file /log CVE-2024-497207.8In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic e CVE-2024-497225.5In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to CVE-2024-497247.0In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a CVE-2024-497285.5In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could l CVE-2024-49739.8A vulnerability classified as critical was found in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the fil CVE-2024-497307.8In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with n