CVE-2024-23348

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary JavaScript code by uploading a specially crafted SVG file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-233495.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apach CVE-2024-23356.4The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget link URLs in all versions up to, an CVE-2024-233506.5Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed CVE-2024-233517.8Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.CVE-2024-233527.5Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.CVE-2024-233537.5Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.CVE-2024-233547.8Memory corruption when the IOCTL call is interrupted by a signal.CVE-2024-233557.8Memory corruption when keymaster operation imports a shared key.CVE-2024-233567.8Memory corruption during session sign renewal request calls in HLOS.CVE-2024-233575.5Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.CVE-2024-233587.5Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.CVE-2024-233598.2Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.