CVE-2024-49708

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form designed for setting delivery address with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in version 79.0

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-497094.4Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to CVE-2024-49715.4The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all ver CVE-2024-497147.8In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device e CVE-2024-49729.8A vulnerability classified as critical has been found in code-projects Simple Chat System 1.0. This affects an unknown part of the file /log CVE-2024-497207.8In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic e CVE-2024-497225.5In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to CVE-2024-497247.0In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a CVE-2024-497285.5In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could l CVE-2024-49739.8A vulnerability classified as critical was found in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the fil CVE-2024-497307.8In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with n CVE-2024-497314.0In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a CVE-2024-497327.8In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user consent due to a miss