CVE-2024-33976

Name of the Vulnerable Software and Affected Versions E-Negosyo System version 1.0

Description A Cross-Site Scripting (XSS) issue allows an attacker to partially take over an authenticated user's browser session. This can be achieved by sending a specially crafted JavaScript payload via the id parameter in the "/admin/user/index.php" API endpoint.

Recommendations For E-Negosyo System version 1.0, consider disabling access to the "/admin/user/index.php" endpoint until a patch is available, or restrict the use of the id parameter to minimize the risk of exploitation.