CVE-2024-31219

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the `/u/:username/activity/reactions` endpoint.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-31224.9CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with ad CVE-2024-312207.3Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to CVE-2024-312215.9Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all device CVE-2024-312235.3Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable us CVE-2024-312249.8GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73 CVE-2024-312259.0RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontr CVE-2024-312262.9Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may CVE-2024-312274.4Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL se CVE-2024-312286.5Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially cr CVE-2024-312295.5Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a t CVE-2024-31237.2CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administr CVE-2024-312305.3Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adapti