CVE-2024-22927

Deeper analysis

CVE-2024-22927 is a reflected cross-site scripting vulnerability (CWE-79) affecting the func parameter in EyouCMS version 1.6.5. The flaw permits a remote attacker to supply a crafted URL that executes arbitrary script in the victim's browser, as reflected by its CVSS 3.1 score of 6.1 with network attack vector, low complexity, no authentication, and required user interaction.

An unauthenticated remote attacker can exploit the issue by delivering a malicious link to a target user; successful exploitation allows the attacker to run JavaScript in the context of the EyouCMS application, enabling actions such as cookie theft or limited interface manipulation within the changed security scope.

The two referenced GitHub issues document the discovery but contain no vendor advisory, patch information, or mitigation guidance.

EPSS scores have remained near 0.18 with only minor fluctuation between the recorded current and peak values, indicating no material post-disclosure surge in observed exploitation interest.