CVE-2024-39308

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-393099.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to CVE-2024-39315.4A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality o CVE-2024-393105.4The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to CVE-2024-393115.4Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of CVE-2024-393125.3Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit enc CVE-2024-393135.3toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private CVE-2024-393144.7toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative pa CVE-2024-393156.5Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentional CVE-2024-393166.5Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReD CVE-2024-393174.9Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a lon CVE-2024-393185.4The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable CVE-2024-393195.3aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022