CVE-2024-1636

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Potential Cross-Site Scripting (XSS) in the page editing area.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Progress Software CorporationSitefinity>= 13.3.7600, < 13.3.7649; >= 14.4.8100, < 14.4.8135; >= 15.0.8200, < 15.0.8227
progresssitefinity>= 13.3.7600, < 13.3.7649; >= 14.4.8100, < 14.4.8135; >= 15.0.8200, < 15.0.8227

References

Timeline

Published
Feb 28, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-16374.3The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and noncCVE-2024-16389.1The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute reCVE-2024-16396.5The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on tCVE-2024-16405.3The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulneCVE-2024-16415.4The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check oCVE-2024-16424.3The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request ForgeryCVE-2024-16439.1By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data wCVE-2024-16448.8Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI.CVE-2024-16454.3The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistratiCVE-2024-16468.2parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checksCVE-2024-16477.5Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application doeCVE-2024-16487.5electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application