CVE-2024-37156

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-80

Affected software

Vendor	Product	Versions
sulu	SuluFormBundle	>=2.0.0, < 2.5.3

References

Timeline

Published: Jun 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-371575.3Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `te CVE-2024-371588.1Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accoun CVE-2024-371596.5Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested CVE-2024-37166.2A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in CVE-2024-371604.8Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scri CVE-2024-371616.1MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting CVE-2024-371625.3zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stac CVE-2024-371637.5SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecure CVE-2024-371648.5Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply cu CVE-2024-371656.1Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulne CVE-2024-371668.9ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code CVE-2024-371674.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that th