CVE-2024-36827

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335Issue Tracking, Third Party Advisory
https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335Issue Tracking, Third Party Advisory

Timeline

Published: Jun 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-368297.5Incorrect access control in Teldat M1 v11.00.05.50.01 allows attackers to obtain sensitive information via a crafted query string.CVE-2024-368315.3A NULL pointer dereference in the plugins_call_handle_uri_clean function of D-Link DAP-1520 REVA_FIRMWARE_1.10B04_BETA02_HOTFIX allows attac CVE-2024-368327.5A NULL pointer dereference in D-Link DAP-1513 REVA_FIRMWARE_1.01 allows attackers to cause a Denial of Service (DoS) via a crafted web reque CVE-2024-368377.5SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the CVE-2024-36847.2A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the M CVE-2024-368409.1SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive CVE-2024-368427.3An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Numbe CVE-2024-368437.5libmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function.CVE-2024-368447.5libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer. This vulnerability allows attackers to cause a Den CVE-2024-368454.3An invalid pointer in the modbus_receive() function of libmodbus v3.1.6 allows attackers to cause a Denial of Service (DoS) via a crafted me CVE-2024-36859.8A vulnerability, which was classified as critical, was found in DedeCMS 5.7.112-UTF8. Affected is an unknown function of the file stepselect CVE-2024-368567.5RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. An attacker can exhaust system memo