CVE-2024-2171

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-21729.8The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation CVE-2024-217226.3The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.CVE-2024-217234.3Inadequate parsing of URLs could result into an open redirect.CVE-2024-217246.1Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.CVE-2024-217256.1Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.CVE-2024-217266.5Inadequate content filtering leads to XSS vulnerabilities in various components.CVE-2024-217276.1XSS vulnerability in DP Calendar component for Joomla.CVE-2024-217286.1An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that prov CVE-2024-217296.1Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.CVE-2024-21738.8Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access CVE-2024-217305.4The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.CVE-2024-217316.1Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.