CVE-2024-52680 describes a Cross Site Scripting (XSS) vulnerability affecting EyouCMS 1.6.7. The issue exists in the /login.php endpoint when accessed with parameters m=admin, c=System, a=web, and lang=cn. This vulnerability allows an attacker to inject and execute arbitrary scripts in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and affects confidentiality and integrity but not availability. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation of this XSS vulnerability can lead to limited confidentiality and integrity impacts, such as theft of user credentials or session tokens, or manipulation of web content. The vulnerability does not affect system availability. The attack requires user interaction and can be executed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewall (WAF) rules to detect and block malicious input targeting the vulnerable endpoint. Additionally, exercising caution with user input and limiting exposure of the affected endpoint may reduce risk.