# CVE-2024-7075: Management console user search XSS via input encoding failure

Source: https://junglewise.ai/threats/cve-2024-7075-the-user-search-function-within-the-management-console-fails-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2024-7075 · Severity: medium · CVSS 4.6 · Published 2026-11-02

A management console's user search function fails to properly encode user input before displaying results in the browser, allowing attackers to inject malicious scripts. An attacker can exploit this to redirect users to malicious sites, deface the web interface, or steal sensitive information displayed in the console. The vulnerability is mitigated by the use of httpOnly flags on session cookies, which prevents session hijacking.

Technologies: [<UNKNOWN>](https://junglewise.ai/threats/technologies/x-unknown).

## Quick answers

**Is CVE-2024-7075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-7075 being exploited in the wild.

**How severe is CVE-2024-7075?** Medium severity, with a CVSS score of 4.6, published 2 November 2026.

**Which products and versions are affected?** <UNKNOWN>.

**Is there a fix for CVE-2024-7075?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-7075 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-7075?** Check whether you run <UNKNOWN>. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a reflected cross-site scripting (XSS) vulnerability in the user search function of a management console where user-supplied input is rendered without proper HTML encoding. An authenticated or unauthenticated attacker can craft a malicious search query that executes JavaScript in the victim's browser within the console's security context, allowing data theft or UI manipulation. httpOnly session cookies provide partial mitigation against session token theft, though other attack vectors remain viable.

## Affected products

- <UNKNOWN>

## Timeline

- 2026-11-02: disclosed

## References

- [https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3569/](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3569/)

## Related threats

- [System component denial of service vulnerability](https://junglewise.ai/threats/cve-2026-95784-a-vulnerability-exists-in-a-system-component-that-may-under)
- [Hessian remoting authentication bypass with non-root context path](https://junglewise.ai/threats/cve-2026-97874-when-hessian-remoting-is-configured-with-basic-authentication-the)
- [Embedded server weak session ID generation](https://junglewise.ai/threats/cve-2026-111259-the-embedded-server-generates-http-session-identifiers-with-a)
- [Web application request routing security constraint bypass](https://junglewise.ai/threats/cve-2026-111258-the-optional-request-routing-feature-forwards-requests-to-their)
- [SSH administration service authentication bypass](https://junglewise.ai/threats/cve-2026-111239-the-optional-ssh-administration-service-grants-full-access-to)