CVE-2024-28635

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28635

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

C

ross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

References
Link Resource
https://github.com/surveyjs/survey-creator/issues/5285 Exploit Issue Tracking
https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt Broken Link
https://github.com/surveyjs/survey-creator/issues/5285 Exploit Issue Tracking
https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:devsoftbaltic:survey-creator:*:*:*:*:*:*:*:*
History

17 Jun 2025, 14:05

Type Values Removed Values Added
First Time Devsoftbaltic survey-creator
CPE cpe:2.3:a:devsoftbaltic:survey_creator:*:*:*:*:*:*:*:* cpe:2.3:a:devsoftbaltic:survey-creator:*:*:*:*:*:*:*:*

17 Jun 2025, 13:52

Type Values Removed Values Added
First Time Devsoftbaltic survey Creator
Devsoftbaltic
References () https://github.com/surveyjs/survey-creator/issues/5285 - () https://github.com/surveyjs/survey-creator/issues/5285 - Exploit, Issue Tracking
References () https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt - () https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt - Broken Link
CPE cpe:2.3:a:devsoftbaltic:survey_creator:*:*:*:*:*:*:*:*

21 Nov 2024, 09:06

Type Values Removed Values Added
References () https://github.com/surveyjs/survey-creator/issues/5285 - () https://github.com/surveyjs/survey-creator/issues/5285 -
References () https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt - () https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt -

02 Aug 2024, 16:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
CWE CWE-79
Information

Published : 2024-03-21 04:15

Updated : 2025-06-17 14:05

NVD link : CVE-2024-28635

Mitre link : CVE-2024-28635

CVE.ORG link : CVE-2024-28635

JSON object : View

Products Affected

devsoftbaltic

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')