CVE-2024-27136

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-271375.3In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulateCVE-2024-271387.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user regisCVE-2024-271397.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthCVE-2024-27146.5A vulnerability has been found in Campcodes Complete Online DJ Booking System 1.0 and classified as critical. Affected by this vulnerabilityCVE-2024-271405.4** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApachCVE-2024-271415.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it isCVE-2024-271425.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it isCVE-2024-271439.8Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote CVE-2024-271449.8The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any inseCVE-2024-271459.8The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba priCVE-2024-271466.7The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.CVE-2024-271477.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer.