CVE-2024-27593

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored cross-site scripting (XSS) vulnerability in the Filter function of Eramba Version 3.22.3 Community Edition allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the filter name field. This vulnerability has been fixed in version 3.23.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
eramba	eramba	>= 3.22.3, < 3.23.0

References

Timeline

Published: May 15, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-27605.5Bkav Home v7816, build 2403161130 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x222240 IOCTL code of the Bkav CVE-2024-276029.1Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api CVE-2024-276049.8Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.CVE-2024-276057.5Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.CVE-2024-276096.5Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel.CVE-2024-27616.8The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at CVE-2024-276126.2Numbas editor before 7.3 mishandles editing of themes and extensions.CVE-2024-276137.3Numbas editor before 7.3 mishandles reading of themes and extensions.CVE-2024-276197.3Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. Any user having read/write access to ftp server can write directly to CVE-2024-27625.4The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its G CVE-2024-276207.5An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API.CVE-2024-276227.2A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This v