{"id":"CVE-2024-10385","aliases":["EUVD-2024-33583","GHSA-5vp4-pvmw-cjmm"],"status":"published","title":"Stored XSS in DirectAdmin Evo Skin","description":"Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code.\nIf an admin views the ticket, the script might perform actions with their privileges, including command execution. \nThis issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00664,"percentile":0.52054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-12-20T15:52:26Z","modified":"2026-06-17T06:55:31Z","products":[{"vendor":"directadmin","product":"directadmin evolution skin"}],"references":[{"url":"https://cert.pl/en/posts/2024/12/CVE-2024-10385","tags":["third-party-advisory"]},{"url":"https://www.directadmin.com/evolution.php","tags":["product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10385"},{"url":"https://github.com/advisories/GHSA-5vp4-pvmw-cjmm"}],"sources":{"cve":[{"id":"CVE-2024-10385","title":"Stored XSS in DirectAdmin Evo Skin","description":"Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code.\nIf an admin views the ticket, the script might perform actions with their privileges, including command execution. \nThis issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.","status":"published","published":"2024-12-20T15:52:26.083Z","modified":"2024-12-20T16:48:15.413Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-33583","description":"Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code.\nIf an admin views the ticket, the script might perform actions with their privileges, including command execution. \nThis issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.","status":"published","published":"2024-12-20T15:52:26Z","modified":"2024-12-20T16:48:15Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T00:04:33.692832Z"}],"ghsa":[{"id":"GHSA-5vp4-pvmw-cjmm","title":"Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting...","description":"Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code.\nIf an admin views the ticket, the script might perform actions with their privileges, including command execution. \nThis issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.","status":"published","published":"2024-12-20T18:31:32Z","modified":"2024-12-20T18:31:41Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:59:15.325282Z"}],"nvd":[{"id":"CVE-2024-10385","description":"Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code.\nIf an admin views the ticket, the script might perform actions with their privileges, including command execution. \nThis issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.","status":"published","published":"2024-12-20T16:15:21.523Z","modified":"2026-06-17T06:55:31.97Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:40.507978Z"}]}}