CVE-2024-3402

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model, allowing for the injection and execution of malicious JavaScript code within the context of a user's browser. This vulnerability can lead to the execution of arbitrary JavaScript code in the context of other users' browsers, potentially resulting in the hijacking of victims' browsers.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
gaizhenbiao	gaizhenbiao/chuanhuchatgpt	>= unspecified, <= latest

References

https://huntr.com/bounties/389570c4-0bf2-4bc3-84f5-2e7afdba8ed1Exploit, Issue Tracking, Patch, Third Party Advisory
https://huntr.com/bounties/389570c4-0bf2-4bc3-84f5-2e7afdba8ed1Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jun 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-340206.5A stack-based buffer overflow was found in the putSDN() function of mail.c in hcode through 2.1.CVE-2024-340216.8Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploade CVE-2024-340226.7Improper Access Control in some Thunderbolt(TM) Share software before version 1.0.49.9 may allow an authenticated user to potentially enable CVE-2024-340238.4Untrusted pointer dereference in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privileg CVE-2024-340246.3Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an un CVE-2024-340259.8CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. This could result in an attacker b CVE-2024-340269.8A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _v3 b4702061dc14d10248 CVE-2024-340277.8In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_CVE-2024-340286.7Uncontrolled search path in some Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows before version 2024.1.0.142, gr CVE-2024-340294.3Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<g CVE-2024-34037.5imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from CVE-2024-340304.7In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Return error for int_map allocation failure Return -