CVE-2024-35240

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue which would enable attackers to inject malicious code into Print Functionality. This issue has been addressed in versions 12.1.4, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-352418.8Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commaCVE-2024-352428.8Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running insidCVE-2024-352449.1There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by CVE-2024-352456.7Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated CVE-2024-352467.5An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.CVE-2024-352475.5In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current impleCVE-2024-352487.3Microsoft Dynamics 365 Business Central Elevation of Privilege VulnerabilityCVE-2024-352498.8Microsoft Dynamics 365 Business Central Remote Code Execution VulnerabilityCVE-2024-35255.4A vulnerability, which was classified as problematic, was found in Campcodes Online Event Management System 1.0. Affected is an unknown funcCVE-2024-352507.8Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityCVE-2024-352527.5Azure Storage Movement Client Library Denial of Service VulnerabilityCVE-2024-352534.4Microsoft Azure File Sync Elevation of Privilege Vulnerability
CVE-2024-35240: Medium severity, CVSS 5.4 | Vulnix