First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-41725

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Dover Fueling Solutions (DFS)	ProGauge MAGLINK LX CONSOLE	<= 3.4.2.2.6
Dover Fueling Solutions (DFS)	ProGauge MAGLINK LX4 CONSOLE	<= 4.17.9e
doverfuelingsolutions	maglink_lx_console	<= 3.4.2.2.6
doverfuelingsolutions	maglink_lx4_console	<= 4.17.9e

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04Third Party Advisory, US Government Resource

Timeline

Published: Sep 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-417267.5Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary e CVE-2024-417277.5In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traff CVE-2024-417282.7Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer CVE-2024-417294.3Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is other CVE-2024-41739.8A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform CVE-2024-417309.8In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can CVE-2024-417314.3SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be CVE-2024-417325.4SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depen CVE-2024-417335.3In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacke CVE-2024-417344.3Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an under CVE-2024-417355.4SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing l CVE-2024-417364.3Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causi

CVE-2024-41725: Medium severity, CVSS 6.1 | Vulnix