CVE-2024-10288

Name of the Vulnerable Software and Affected Versions LocalServer version 1.0.9

Description A Cross-Site Scripting (XSS) issue allows a remote user to send a specially crafted query to an authenticated user, potentially stealing their session details. This is achieved through the "/mlss/SubscribeToList" API endpoint, with the ListName parameter being vulnerable.

Recommendations For LocalServer version 1.0.9, as a temporary workaround, consider restricting access to the "/mlss/SubscribeToList" API endpoint or avoiding the use of the ListName parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.