Back to Database
Status published
Medium
CVE-2024-50348
InstantCMS has a Cross Site Scripting Vulnerability
Vulnerability Description
InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-50348
Credits & Attribution
No credits recorded in the NVD database.
References
More from instantsoft
View All →CVE-2025-59055
InstantCMS vulnerable to Server-Side Request Forgery via package installer
Medium
4.7
CVE-2024-31213
InstantCMS Open Redirect vulnerability
Low
3.5
CVE-2024-31212
SQL injection in index_chart_data action
Medium
6.7
CVE-2023-4928
SQL Injection in instantsoft/icms2
High
7.2
CVE-2023-4879
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
Low
3.5
Affected Vendor
instantsoft
View all reports →Affected Software
icms2
Vulnerable Versions:
< 2.16.3
Timeline
Official Publish:
October 29th, 2024
Last Modified:
October 30th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N