BaseFortify

Publication date: 2025-12-11

Last updated on: 2025-12-11

Assigner: VulnCheck

Description

PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. Attackers can insert a payload in the 'Redirect From' field to execute arbitrary JavaScript when administrators view the redirects page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-11

Last Modified

2025-12-11

Generated

2026-07-07

AI Q&A

2025-12-12

EPSS Evaluated

2026-07-05

NVD

CVE-2024-58297

Affected Vendors & Products

Vendor	Product	Version / Range
pyrocms	pyrocms	3.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in PyroCMS v3.0.1. It occurs in the admin redirects configuration, where attackers can inject malicious scripts by inserting a payload into the 'Redirect From' field. When administrators view the redirects page, the injected JavaScript executes, potentially compromising the admin interface.

Impact Analysis

The vulnerability allows attackers to execute arbitrary JavaScript in the context of the administrator's browser. This can lead to unauthorized actions such as stealing admin session cookies, performing actions on behalf of the admin, or defacing the admin interface, potentially compromising the security and integrity of the system.

Hi! I’m here to help you understand CVE-2024-58297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70