First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-32492

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
znuny	znuny	>= 7.0.1, <= 7.0.16

References

Timeline

Published: Apr 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-324938.8An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the CVE-2024-324986.5An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur vi CVE-2024-324999.8Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed.CVE-2024-32506.5It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unpr CVE-2024-325019.8A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13,CVE-2024-325028.4An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, E CVE-2024-325037.8An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, E CVE-2024-325047.8An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, E CVE-2024-325055.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor ElementsKit Elementor addons Li CVE-2024-325065.4Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a t CVE-2024-325078.8Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.Thi CVE-2024-325085.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allow

CVE-2024-32492: High severity, CVSS 7.1 | Vulnix