CVE-2024-33328: Lumis Experience Platform

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in the component main.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the pageId parameter.

Affected products

• Lumis Lumis Experience Platform: from 15.0.0, before 16.2.0 (fixed in 16.2.0)

Published 2024-06-26. Last modified 2026-06-17.