CVE-2024-25627

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-256287.6Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even a CVE-2024-256295.5c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.con CVE-2024-25639.8A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteI CVE-2024-256305.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cili CVE-2024-256315.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvs CVE-2024-256328.8eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with cert CVE-2024-256335.4eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new us CVE-2024-256346.5alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The att CVE-2024-256358.8alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USE CVE-2024-256368.8Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Act CVE-2024-256375.4October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX ha CVE-2024-256388.9dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker t