medium4.8Public exploit code
CVE-2024-50859
The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS)2025-04-14 · remote · multiple
Impact
The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gestioip | Gestioip | Version 3.5.7 |