CVE-2024-34469

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a
rukovoditelrukovoditel< 3.5.3

References

Timeline

Published
May 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-34476.0A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size ofCVE-2024-344708.6An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /publiCVE-2024-344715.4An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exists in the mliRealtimeCVE-2024-344725.5An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliCVE-2024-344735.3An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message type during xApp regiCVE-2024-344747.8Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM.CVE-2024-344757.5Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authenticationCVE-2024-344765.3Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/nCVE-2024-344777.8configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (becauseCVE-2024-344787.5btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failuCVE-2024-344799.8SourceCodester Computer Laboratory Management System 1.0 allows classes/Master.php id SQL Injection.CVE-2024-34485.0Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:che
CVE-2024-34469: High severity, CVSS 7.1 | Vulnix