https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 07 May 2026 13:12:24 +0000 https://vulnerability.circl.lu/sighting/0c25cf14-ec01-436b-9253-a226d0fdcf45/export {"uuid": "0c25cf14-ec01-436b-9253-a226d0fdcf45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45057", "type": "seen", "source": "https://t.me/cvedetector/4357", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-45057 - i-Educar XSS Vulnerability\", \n \"Content\": \"CVE ID : CVE-2024-45057 \nPublished : Aug. 28, 2024, 9:15 p.m. | 42\u00a0minutes ago \nDescription : i-Educar is free, completely online school management software that allows school secretaries, teachers, coordinators and area managers. The lack of sanitization of user-controlled parameters for generating HTML field values \u200b\u200bdynamically leads to XSS (Cross-Site Scripting) attacks. The dynamic generation of HTML fields in the ieducar/intranet/include/clsCampos.inc.php file does not perform the correct validation or sanitization, reflecting the user-controlled values \u200b\u200bto be shown in the page's HTML. This allows an attacker to inject a specific XSS payload into a parameter. Successful exploitation of this flaw allows an attacker to trick the victim into clicking a vulnerable URL, enabling JavaScript scripts to be executed in the browser. Due to the configuration of session cookies, with the HttpOnly and SameSite=Lax flags being defined, there is little an attacker can do to steal the session or force the victim to perform actions within the application. This issue hast been patched but a new release has not yet been made. Users are advised to contact the developer and to coordinate an update schedule. \nSeverity: 6.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"28 Aug 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-29T00:19:45.000000Z"} {"uuid": "0c25cf14-ec01-436b-9253-a226d0fdcf45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45057", "type": "seen", "source": "https://t.me/cvedetector/4357", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-45057 - i-Educar XSS Vulnerability\", \n \"Content\": \"CVE ID : CVE-2024-45057 \nPublished : Aug. 28, 2024, 9:15 p.m. | 42\u00a0minutes ago \nDescription : i-Educar is free, completely online school management software that allows school secretaries, teachers, coordinators and area managers. The lack of sanitization of user-controlled parameters for generating HTML field values \u200b\u200bdynamically leads to XSS (Cross-Site Scripting) attacks. The dynamic generation of HTML fields in the ieducar/intranet/include/clsCampos.inc.php file does not perform the correct validation or sanitization, reflecting the user-controlled values \u200b\u200bto be shown in the page's HTML. This allows an attacker to inject a specific XSS payload into a parameter. Successful exploitation of this flaw allows an attacker to trick the victim into clicking a vulnerable URL, enabling JavaScript scripts to be executed in the browser. Due to the configuration of session cookies, with the HttpOnly and SameSite=Lax flags being defined, there is little an attacker can do to steal the session or force the victim to perform actions within the application. This issue hast been patched but a new release has not yet been made. Users are advised to contact the developer and to coordinate an update schedule. \nSeverity: 6.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"28 Aug 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-29T00:19:45.000000Z"} https://vulnerability.circl.lu/sighting/0c25cf14-ec01-436b-9253-a226d0fdcf45/export Thu, 29 Aug 2024 00:19:45 +0000