Skip to content
Fencer Vulns
low 3.5

CVE-2026-124498 json

Convene Azeus Convene Board Management Portal dummy_launcher.jsp cross site scripting

published 2026-11-08 3 h ago modified 2026-11-08 3 h ago also EUVD-2026-119757

cvss
3.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacted element is an unknown function of the file /jsp/ge/dummy_launcher.jsp. Executing a manipulation of the argument REDIRECT_URL can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Exploits and checks

  • gist.github.com https://gist.github.com/OmarXtream/f6c5151914d6216f04c9d0a12647f26c referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA 3.1 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
CNA 3.0 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
CNA 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C
CNA 4.0 2.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CNA 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

  • Convene Azeus Convene Board Management Portal

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.