Vulnerabilities

TI-2024-34149 CVE-2024-50861 · GHSA-mx7x-mmcr-wf43

The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS.

MEDIUM 60

The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00833 Published 2025-01-14 No fix listed CWE-79

TI-2024-34148 CVE-2024-50859 · GHSA-hg4r-9c4x-96jw

MEDIUM 55

The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00902 Published 2025-01-14 No fix listed CWE-79

TI-2024-34147 CVE-2024-50858 · GHSA-mm92-9vfh-5m9g

HIGH 73

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01782 Published 2025-01-14 No fix listed CWE-352

TI-2024-34146 CVE-2024-50857 · GHSA-x7fx-57rj-7whh

MEDIUM 55

The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01249 Published 2025-01-14 No fix listed CWE-79

TI-2024-32488 CVE-2024-48760 · GHSA-2qvv-vrv2-ppx8

HIGH 82

An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.4578 Published 2025-01-14 No fix listed CWE-434