CVE-2024-24050: Sourcecodester Workout Journal App · Cross Site Scripting (XSS)
Source CVE Database V5
Not known to be exploited · CVSS 4.7 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 20 Mar 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-24050, organizations should immediately review and sanitize all user inputs, especially the firstname and lastname parameters in /add-user.php, using robust server-side validation and context-appropriate output encoding to neutralize any injected scripts. Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in browsers. If possible, disable or restrict the vulnerable functionality until a patch or update is available. Educate users to avoid clicking suspicious links and implement web application firewalls (WAFs) with rules to detect and block XSS payloads targeting this endpoint. Monitor logs for unusual input patterns or error messages that could indicate attempted exploitation. Engage with the vendor or community to obtain or develop patches and apply them promptly once available. Conduct regular security testing, including automated scanning and manual penetration testing, to identify and remediate similar vulnerabilities proactively.
Description
Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters firstname and lastname in /add-user.php.