CVE-2024-41805

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting enables execution of malicious JavaScript in the context of a user’s browser if that user clicks on a malicious link, allowing phishing attacks that could lead to credential theft. Tracks version 2.7.1 is patched. No known complete workarounds are available.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
TracksApp	tracks	< 2.7.1
tracksapp	tracks	2.7.1

References

Timeline

Published: Jul 26, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-418065.3The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts i CVE-2024-418085.4The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log.CVE-2024-418096.1OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-si CVE-2024-41818.8A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework fro CVE-2024-418106.1Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains a CVE-2024-418113.9ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, suscep CVE-2024-418127.5txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Ser CVE-2024-418137.5txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and CVE-2024-418157.0Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/CVE-2024-418165.4Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[co CVE-2024-418177.8ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick`CVE-2024-418187.5fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.