CVE-2024-7900

Summary

CVE-2024-7900 is a newly disclosed cross-site scripting (XSS) vulnerability affecting the xiaohe4966 TpMeCMS 1.3.3.2. The issue lies within the Basic Configuration Handler component and can be exploited through manipulation of the arguments Site Name, Beian, Contact address, copyright, or technical support in the /h.php/general/config?ref=addtabs file. This vulnerability allows attackers to inject malicious code, potentially launching remote attacks. Despite early notification, the vendor has not responded to disclosure efforts, leaving users exposed to this exploit.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.