CVE-2024-51226

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-51226", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-23T16:53:18.599Z", "dateReserved": "2024-10-28T00:00:00.000Z", "datePublished": "2026-03-23T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-23T15:30:22.547Z"}, "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Search parameter."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/Buckdray/vulnerability-research"}, {"url": "https://github.com/Buckdray/vulnerability-research/tree/main/CVE-2024-51226"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T16:52:56.707439Z", "id": "CVE-2024-51226", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:53:18.599Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-51226", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T16:52:56.707439Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:52:52.291Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/Buckdray/vulnerability-research"}, {"url": "https://github.com/Buckdray/vulnerability-research/tree/main/CVE-2024-51226"}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Search parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-23T15:30:22.547Z"}}}, "cveMetadata": {"cveId": "CVE-2024-51226", "state": "PUBLISHED", "dateUpdated": "2026-03-23T16:53:18.599Z", "dateReserved": "2024-10-28T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-23T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpgurukul:vehicle_record_management_system:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "D6AE144F-2A5F-4F48-899F-732293FA1DB6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Search parameter."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado en el componente /admin/search-vehicle.php de Phpgurukul Vehicle Record Management System v1.0 permite a los atacantes ejecutar scripts web o HTML arbitrarios mediante la inyecci\u00f3n de una carga \u00fatil dise\u00f1ada en el par\u00e1metro Search."}], "id": "CVE-2024-51226", "lastModified": "2026-06-17T08:05:31.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-51226", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T16:52:56.707439Z", "version": "2.0.3"}}]}, "published": "2026-03-23T16:16:31.930", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/Buckdray/vulnerability-research"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/Buckdray/vulnerability-research/tree/main/CVE-2024-51226"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 91.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "vehicle_record_management_system", "vendor": "phpgurukul"}], "analysis": {"en": {"generated_at": "2026-03-24T20:32:58.403262+00:00", "value": {"mitigation_remediation": ["Apply any vendor\u2011supplied patch or upgrade to a newer version of the Vehicle Record Management System", "Ensure all user\u2011supplied input, especially the Search field in /admin/search-vehicle.php, is properly sanitized or encoded before being displayed", "Restrict the admin search page to authorized administrators and enforce strong authentication"], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting (XSS) enabling arbitrary script execution in a user\u2019s browser"}, "threat_synthesis": {"affected_systems": "The vulnerability hits installations of Phpgurukul Vehicle Record Management System\u00a01.0. Only systems running that exact version with access to the admin search feature are affected.", "description_and_impact": "A stored cross\u2011site scripting flaw resides in the /admin/search-vehicle.php page of Phpgurukul Vehicle Record Management System version\u202f1.0. The flaw allows attackers to inject malicious scripts via the Search parameter; those scripts are stored and later rendered by the server without escaping. When an administrator or any user views the search results, the browser interprets the injected code, potentially compromising session cookies, defacing the interface, or exfiltrating data. This weakness falls under CWE\u201179, a typical stored input injection problem.", "risk_and_exploitability": "The CVSS base score of 6.1 indicates medium severity. The EPSS score of less than\u202f1\u202f% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits yet. Likely attack requires access to the admin interface; if the interface is publicly reachable or an attacker can gain credentials, the stored script could be executed whenever a user loads the search results. If the admin area is well protected, the risk depends on the strength of authentication and the potential for credential compromise."}}}}, "created": "2026-03-24T10:35:04.857062+00:00", "title": "Stored XSS in Vehicle Record Management System Search Feature", "updated": "2026-03-25T14:50:13.863260+00:00", "vendors": ["phpgurukul", "phpgurukul$PRODUCT$vehicle_record_management_system"]}