CVE-2024-33326: Lumis Experience Platform

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the lumPageID parameter.

Affected products

• Lumis Lumis Experience Platform: from 15.0, before 16.2 (fixed in 16.2)

Published 2024-06-26. Last modified 2026-06-17.