CVE-2024-37878

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtime/twcms_view/default,index.htm.php" PHP directly echoes parameters input from external sources

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/sylvieverykawaii/243f1756151bee027725c6961d8c1ba9Third Party Advisory
https://gist.github.com/sylvieverykawaii/243f1756151bee027725c6961d8c1ba9Third Party Advisory

Timeline

Published: Jun 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-378794.8Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitr CVE-2024-37886.6Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers CVE-2024-378807.5The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a tim CVE-2024-378815.3SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirect CVE-2024-378828.1Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more CVE-2024-378834.3Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2024-378845.4Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they on CVE-2024-378857.8The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop CVE-2024-378864.7user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is CVE-2024-378873.5Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is CVE-2024-378886.1The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execut CVE-2024-378896.5MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. Thi