CVE-2024-23181

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the logged-in user's web browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
appleple inc.	a-blog cms Ver.3.1.x series	prior to Ver.3.1.7
appleple inc.	a-blog cms Ver.3.0.x series	prior to Ver.3.0.29
appleple inc.	a-blog cms Ver.2.11.x series	prior to Ver.2.11.58
appleple inc.	a-blog cms Ver.2.10.x series	prior to Ver.2.10.50
appleple inc.	a-blog cms	Ver.2.9.0 and earlier

References

https://developer.a-blogcms.jp/blog/news/JVN-34565930.htmlVendor Advisory
https://jvn.jp/en/jp/JVN34565930/Third Party Advisory
https://developer.a-blogcms.jp/blog/news/JVN-34565930.htmlVendor Advisory
https://jvn.jp/en/jp/JVN34565930/Third Party Advisory

Timeline

Published: Jan 23, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-231828.1Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0 CVE-2024-231835.4Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29 CVE-2024-231845.0Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is al CVE-2024-231857.5Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the mess CVE-2024-231866.1E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attacker CVE-2024-231876.1Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Att CVE-2024-231886.5Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Co CVE-2024-231895.4Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploi CVE-2024-23196.1Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2. An attacker could store a specially craft CVE-2024-231905.4Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this CVE-2024-231915.4Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exp CVE-2024-231926.1RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised