CVE

CVE-2024-9007

5.3

CVSSmedium

Exploitable remotely over the internet · low-privilege account sufficient.

Description

A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue.

Attack Vector

Network

Privileges Req.

Low

User Interaction

None

123solar

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumWeb Vulnerabilities~10 seconds

123Solar 1.8.4.5 - Cross-Site Scripting

123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting (XSS) via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. References: https://github.com/Hebing123/cve/issues/73 https://nvd.nist.gov/vuln/detail/CVE-2024-9007 Remediation: Update 123Solar to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the date1 parameter in detailed.php.

9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: 123solar

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →