PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-33724 SOPlanning CVE debrief

A Cross Site Scripting (XSS) vulnerability exists in SOPlanning 1.52.00 via the groupe_id parameter to process/groupe_save.php. This CVE was published on 2026-05-08T06:16:09.547Z and was last modified on 2026-10-28T09:10:00.193Z. The vulnerability allows unauthorized actions within the application. Defenders responsible for SOPlanning installations should assess the potential impact and prioritize verification and mitigation efforts. The CVSS score for this vulnerability is 5.4, with a severity rating of MEDIUM.

Vendor
SOPlanning
Product
SOPlanning 1.52.00
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-10-28
Advisory published
2026-05-08
Advisory updated
2026-10-28

Who should care

Defenders responsible for SOPlanning installations should assess the potential impact of this XSS vulnerability and prioritize verification and mitigation efforts.

Why it matters

CVE-2024-33724 is a Cross Site Scripting (XSS) vulnerability in SOPlanning 1.52.00 that could allow unauthorized actions within the application. Defenders responsible for SOPlanning installations should assess the potential impact and prioritize verification and mitigation efforts.

  • XSS attacks could lead to unauthorized actions within the SOPlanning application
  • Successful exploitation could result in the injection of malicious scripts into the application
  • Defenders should verify the presence of this vulnerability in their SOPlanning installations
  • Remediation efforts should focus on applying patches or workarounds to prevent XSS attacks

Technical summary

The SOPlanning application version 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. The CVSS score for this vulnerability is 5.4, with a severity rating of MEDIUM. This vulnerability could allow unauthorized actions within the application. Defenders should prioritize verifying the presence of this vulnerability in their SOPlanning installations and assess the potential impact of XSS attacks.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their SOPlanning installations and assess the potential impact of XSS attacks.

Recommended defensive actions

  • Verify the presence of SOPlanning 1.52.00 in your environment
  • Assess the potential impact of XSS attacks on your SOPlanning installation
  • Consider implementing compensating controls to mitigate XSS attacks

Evidence notes

The CVE record and NVD entry provide information about the vulnerability, but do not offer specific details on exploitation or affected versions. The SOPlanning application version 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. Defenders should verify the presence of this vulnerability in their SOPlanning installations and assess the potential impact of XSS attacks. The information provided is based on the CVE record and NVD,

Sources and references

Verified primary and authoritative sources

  • CVE-2024-33724 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-33724

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-33724 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-33724

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fuzzlove/soplanning-1.52-exploits

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://github.com/fuzzlove/soplanning-1.52-exploits/blob/main/soplanning-XSS-README.txt

    134c704f-9b21-4f2e-91b3-4a467353bcc0

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.