CVE-2024-39307

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-393085.4RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by imprope CVE-2024-393099.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to CVE-2024-39315.4A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality o CVE-2024-393105.4The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to CVE-2024-393115.4Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of CVE-2024-393125.3Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit enc CVE-2024-393135.3toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private CVE-2024-393144.7toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative pa CVE-2024-393156.5Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentional CVE-2024-393166.5Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReD CVE-2024-393174.9Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a lon CVE-2024-393185.4The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable