CVE-2024-33978

Name of the Vulnerable Software and Affected Versions E-Negosyo System version 1.0

Description The issue is related to a Cross-Site Scripting (XSS) vulnerability. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via the category parameter in the "/index.php" API endpoint.

Recommendations For E-Negosyo System version 1.0, as a temporary workaround, consider restricting access to the "/index.php" endpoint or disabling the use of the category parameter until a patch is available. Avoid using the category parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.