{"id":"CVE-2024-50637","aliases":["EUVD-2024-3264","GHSA-hv6m-qj65-26q3"],"status":"published","title":"UnoPim Cross-site Scripting vulnerability","description":"UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which can be used to steal cookies.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00406,"percentile":0.35296,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-11-06T00:00:00Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"Packagist","package":"unopim/unopim","fixed_in":["0.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"unopim/unopim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"unopim/unopim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4"}]}],"versions":["v0.1.0","v0.1.1","v0.1.2","v0.1.3"]}],"products":[{"vendor":"unopim","product":"unopim"},{"vendor":"webkul","product":"unopim"}],"references":[{"url":"https://github.com/unopim/unopim/issues/41","tags":["Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://github.com/unopim/unopim/releases/tag/v0.1.4","tags":["Release Notes","web"]},{"url":"https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50637","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hv6m-qj65-26q3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50637.json","tags":["advisory"]},{"url":"https://github.com/unopim/unopim","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-50637","description":"UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which can be used to steal cookies.","status":"published","published":"2024-11-06T00:00:00Z","modified":"2024-11-07T14:06:04.383Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-3264","description":"UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which can be used to steal cookies.","status":"published","published":"2024-11-06T00:00:00Z","modified":"2024-11-07T14:06:04Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:05:08.721426Z"}],"ghsa":[{"id":"GHSA-hv6m-qj65-26q3","title":"UnoPim Cross-site Scripting vulnerability","description":"UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.\n\nThe vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.","status":"published","published":"2024-11-06T18:31:11Z","modified":"2024-11-06T20:21:57Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-50637","description":"UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which can be used to steal cookies.","status":"published","published":"2024-11-06T17:15:20.68Z","modified":"2026-06-17T08:04:51.4Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:36.560164Z"}],"osv":[{"id":"CVE-2024-50637","description":"UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which can be used to steal cookies.","status":"published","published":"2024-11-06T00:00:00Z","modified":"2026-10-28T02:30:49.059037803Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-hv6m-qj65-26q3","title":"UnoPim Cross-site Scripting vulnerability","description":"UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.\n\nThe vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.","status":"published","published":"2024-11-06T18:31:11Z","modified":"2024-11-06T20:42:21.101794Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}