CVE-2024-31609

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-31615.4The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's attributes in all version CVE-2024-316106.3File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attac CVE-2024-316119.1SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.CVE-2024-316126.5Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access adminis CVE-2024-316135.4BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."CVE-2024-316159.8ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.CVE-2024-316168.8An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(0715 CVE-2024-316175.3OpenLiteSpeed before 1.8.1 mishandles chunked encoding.CVE-2024-31625.4The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all version CVE-2024-316217.6An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 c CVE-2024-31634.3The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attacker CVE-2024-316346.1Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Se