CVE-2024-23183

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute an arbitrary script on the logged-in user's web browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-231845.0Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is al CVE-2024-231857.5Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the mess CVE-2024-231866.1E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attacker CVE-2024-231876.1Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Att CVE-2024-231886.5Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Co CVE-2024-231895.4Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploi CVE-2024-23196.1Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2. An attacker could store a specially craft CVE-2024-231905.4Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this CVE-2024-231915.4Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exp CVE-2024-231926.1RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised CVE-2024-231935.3E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the CVE-2024-231943.3Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to