CVE-2024-0758

MediumCVSS 6.1/10Last modified Jul 14, 2026

Description

MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via crafted molfiles.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
—	—	< 0.3.0

References

https://github.com/advisories/GHSA-2pwh-52h7-7j84Third Party Advisory
https://github.com/ipb-halle/MolecularFaces/security/advisories/GHSA-2pwh-52h7-7j84Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-2pwh-52h7-7j84Third Party Advisory, US Government Resource
https://github.com/advisories/GHSA-2pwh-52h7-7j84Third Party Advisory
https://github.com/ipb-halle/MolecularFaces/security/advisories/GHSA-2pwh-52h7-7j84Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-2pwh-52h7-7j84Third Party Advisory, US Government Resource

Timeline

Published: Jan 19, 2024
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-07597.5Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or a CVE-2024-07607.5A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. T CVE-2024-07617.5The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to ins CVE-2024-07627.8Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoe CVE-2024-07638.1Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attack CVE-2024-07656.5As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then un CVE-2024-07664.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi CVE-2024-07674.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to,CVE-2024-07684.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to CVE-2024-07699.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue i CVE-2024-07707.1A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown f CVE-2024-07715.5A vulnerability has been found in Nsasoft Product Key Explorer 4.0.9 and classified as problematic. Affected by this vulnerability is an unk