CVE-2024-37773

MediumCVSS 4.8/10Last modified Jul 5, 2026

Description

An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2024
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-377748.0A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an CVE-2024-377757.5Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC CVE-2024-377764.8A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a cr CVE-2024-377778.8O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.CVE-2024-377798.8WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script CVE-2024-37787.2The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator CVE-2024-377829.8An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or exe CVE-2024-377835.4A reflected cross-site scripting (XSS) vulnerability in Gladinet CentreStack v13.12.9934.54690 allows attackers to inject malicious JavaScri CVE-2024-37795.5Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker to render ESET’s secu CVE-2024-377916.0DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id.CVE-2024-377947.5Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file.CVE-2024-377957.5A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing t