CVE-2024-43408

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability is fixed in commit a62f711d5600e4e5d86f342d52932cb6221672e7.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-434096.5Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to p CVE-2024-43416.5Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in ExtremePacs Extreme XDS allows Collect Data as Prov CVE-2024-434107.5Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server.CVE-2024-434113.1CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and CVE-2024-434125.4Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting v CVE-2024-434134.8Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting v CVE-2024-434147.5Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph indep CVE-2024-434159.0An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.1 CVE-2024-434165.3GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can CVE-2024-434176.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-434186.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-43425.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, i