CVE-2024-24050

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters firstname and lastname in /add-user.php.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 20, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-240515.5Improper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows attackers to instruct the device's movable parts tCVE-2024-240595.4springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files.CVE-2024-24069.8A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/adCVE-2024-240605.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.CVE-2024-240615.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.CVE-2024-240625.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.CVE-2024-24085.9The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the MaCVE-2024-24099.8The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to iCVE-2024-240919.8Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface.CVE-2024-240927.8SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php.CVE-2024-240939.8SQL Injection vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via Personal Information UpCVE-2024-240959.8Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection.