Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-13055

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

7.1HIGH

EPSS

2.1%

top 15.89%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Unknown DYN Business Panel Phycticio DYN Business Panel

Timeline

PublishedJan 27

Description

The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.7

Affected Packages2 packages

▶CVEListV5unknown/dyn_business_panel1.0.0

▶NVDphycticio/dyn_business_panel1.0.0

🔴Vulnerability Details

CVEList

Dyn Business Panel <= 1.0.0 - Reflected XSS↗2025-01-27

▶

GHSA

GHSA-c33j-w5w4-w9q4: The Dyn Business Panel WordPress plugin through 1↗2025-01-27

▶

💥Exploits & PoCs

Nuclei

Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting

▶