CVE-2024-36076

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
syslifters	sysreptor	< 2024.40

References

https://github.com/Syslifters/sysreptor/releases/tag/2024.40Release Notes
https://github.com/Syslifters/sysreptor/security/advisories/GHSA-2vfc-3h43-vghhVendor Advisory
https://github.com/Syslifters/sysreptor/releases/tag/2024.40Release Notes
https://github.com/Syslifters/sysreptor/security/advisories/GHSA-2vfc-3h43-vghhVendor Advisory

Timeline

Published: May 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-360778.8Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. The attack CVE-2024-360786.7In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the CVE-2024-360796.5An issue was discovered in Vaultize 21.07.27. When uploading files, there is no check that the filename parameter is correct. As a result, a CVE-2024-36085.3The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_design CVE-2024-360809.8Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed. NOTE: this is CVE-2024-360819.8Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. CVE-2024-360826.5SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an adm CVE-2024-36094.3The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a m CVE-2024-36105.3The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th CVE-2024-361036.8OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent at CVE-2024-361049.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBi CVE-2024-361055.3dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.