CVE-2024-42787

No known exploitation. EPSS puts it in the 41st percentile. No fix published yet.

CVSS 3.16.1Medium EPSS percentile41st0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2024-08-26Updated 2025-05-06Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run Kashipara Music Management System and whether users can create or view shared playlists.
Restrict access to playlist creation and viewing to trusted, authenticated users until the issue is resolved.
Ask the vendor for an update: no fixed version has been published.
Review playlists for unexpected titles or descriptions and remove suspicious entries.

May need vendor or contractor work

What it is

From the CVE record

A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "description" parameter fields.

In plain language

Written by AI from the record

Kashipara Music Management System v1.0 has a flaw that can let a malicious playlist affect people who open it, so businesses using it should address it.

Stored XSS in Kashipara Music Management System’s playlist-save endpoint allows attacker-supplied title or description content to execute in another user’s browser when rendered.

If you're affected

Staff account misuse
Altered playlists
Visitor data exposure
Operational disruption

What is it

This is a flaw in the way the system handles playlist titles and descriptions. It is like a playlist label that secretly contains instructions that run when someone reads the label, potentially letting an attacker act through that person’s browser.

Who is affected

This matters to you if you use or run Kashipara Music Management System and allow people to create or view playlists. An attacker can submit the harmful content without signing in, but it only becomes a risk when someone opens a playlist containing it.

How urgent is it

Attackers would need to get someone to open a malicious playlist, and there is no confirmed active exploitation or public attack code. Treat this as an amber issue: restrict the exposed feature and seek vendor guidance promptly, especially if untrusted people can submit playlists.

What to do — in detail

Confirm whether Kashipara Music Management System is deployed, whether the save_playlist function is enabled, and whether playlist titles or descriptions are displayed to other users. No vendor patch or fixed release is currently available, so there is no target version or supported upgrade path to provide.

Until a fix is released, limit playlist creation to trusted accounts, remove public or untrusted access to playlist submission where practical, and inspect existing playlist titles and descriptions for injected HTML or script-like content. Remove suspicious entries, preserve relevant logs, and ask the vendor for a patched release and upgrade guidance.

Monitor web-server and application logs for unusual requests to /music/ajax.php?action=save_playlist, unexpected playlist edits, and reports of browser pop-ups, redirects, or sessions behaving unexpectedly. This CVE is not in CISA’s Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies.

Technical context

CVE-2024-42787 is CVSS 6.1 (Medium): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. It is CWE-79 stored cross-site scripting in the playlist save endpoint, with injected title or description content executing when later rendered in a victim browser. CISA KEV does not list the CVE, no public exploit code is on record, and EPSS predicts a 0.5% likelihood (43rd percentile) with a flat trend. Exploit maturity is therefore low based on the available findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS41st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 41st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

4 events over 253 days, from the signal feeds we watch.

2025-05-06Record updated
2024-08-26Publishedweakness classified, att&ck mapped

Affected products

lopalopaindividual-dev
- music management systemWeb AppOn-premEnterprise Software / document-mgmt

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Scored 6.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact