CVE-2024-10087 Details
Description
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might craft a link containing a malicious script, which then gets directly embedded in references to other resources, what causes the script to run in user's context multiple times. This vulnerability has been patched in version 79.0
A reflected cross-site scripting vulnerability has been identified in the Internet Starter module of SoftCOM iKSORIS system, affecting all versions prior to 79.0. This vulnerability allows an attacker to craft a link with a malicious script that is embedded in references to other resources. As a result, the script executes multiple times in the user's context.
Users can update to version 79.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/en/posts/2025/04/CVE-2024-10087 | [email protected] | Third Party Advisory |
| https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| softcom.wroc iksoris | < 79.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2025 | Initial Analysis | [email protected] |
| Apr 14, 2025 | New CVE Received | [email protected] |