CVE-2024-4336

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-433609.8ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulne CVE-2024-433625.4Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external l CVE-2024-433637.2Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing p CVE-2024-433648.2Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external lin CVE-2024-433658.2Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving e CVE-2024-433669.1zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, i CVE-2024-433677.5Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assum CVE-2024-433686.5The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in CVE-2024-433697.2Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branc CVE-2024-43377.4Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerabili CVE-2024-433707.2gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting (XSS) injection if `.po` dictionary definition fi CVE-2024-433716.5CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader