Cross-site scripting in Survey Creator

보통 6.1CVE-2024-28635 · GHSA-xgj4-2hrf-j4xg · Published 21/03/2024 · updated 17/06/2026

요약

CVE-2024-28635은(는) survey-creator (devsoftbaltic), survey-creator에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.51%, 전체 취약점의 43.6%보다 높음.
조치: 1.9.133 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
survey-creator devsoftbaltic	`≤ 1.9.132`	No fix yet
survey-creator npm	`< 1.9.133`	`1.9.133`

Description

Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

NVD description

Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

References

nvd.nist.gov/vuln/detail/CVE-2024-28635 · ADVISORY
surveyjs/survey-creator · WEB
surveyjs/survey-creator · PACKAGE
packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free