Cross-site scripting in Survey Creator

MOYENNE 6.1CVE-2024-28635 · GHSA-xgj4-2hrf-j4xg · Published 21/03/2024 · updated 17/06/2026

En bref

CVE-2024-28635 est une vulnérabilité MOYENNE (CVSS 6.1) touchant survey-creator (devsoftbaltic), survey-creator.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.51%, plus élevée que 43.6% des vulnérabilités.
Correctif : mettre à jour vers 1.9.133 ou plus récent.

Package	Affected versions	Patched versions
survey-creator devsoftbaltic	`≤ 1.9.132`	No fix yet
survey-creator npm	`< 1.9.133`	`1.9.133`

Description

Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

NVD description

Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

References

nvd.nist.gov/vuln/detail/CVE-2024-28635 · ADVISORY
surveyjs/survey-creator · WEB
surveyjs/survey-creator · PACKAGE
packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free