CVE-2024-43025

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a phishing attack via a crafted payload injected into a sent e-mail.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.rws.com/product-groups/translation_management/multitrans/w/releases/5112/multitrans-7-releasesRelease Notes
https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-43025Third Party Advisory
https://github.com/tomdantuma/CVE/tree/main/2024-43025Third Party Advisory

Timeline

Published: Sep 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-430278.0DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered CVE-2024-430289.8A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code CVE-2024-43038.8ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented. Remote attackers who obtain user CVE-2024-430314.3autMan v2.9.6 was discovered to contain an access control issue.CVE-2024-430324.3autMan v2.9.6 allows attackers to bypass authentication via a crafted web request.CVE-2024-430338.8JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to Attachme CVE-2024-430355.8Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint.CVE-2024-43045.4A Cross-Site Scripting XSS vulnerability has been detected on GT3 Soluciones SWAL. This vulnerability consists in a reflected XSS in the Tit CVE-2024-430409.1Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid paramet CVE-2024-430429.8Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.CVE-2024-430448.8Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by CVE-2024-430456.3Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/