CVE-2024-45406

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-454075.3Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantlyCVE-2024-454086.5eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenCVE-2024-454099.8The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properCVE-2024-45414.3The Custom Product List Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. CVE-2024-454107.5Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-HCVE-2024-454118.6Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templatCVE-2024-454127.5Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled CVE-2024-454138.1The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wrCVE-2024-454149.8The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is resCVE-2024-454159.8The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is CVE-2024-454168.1The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are storCVE-2024-454175.5Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct
CVE-2024-45406: Medium severity, CVSS 4.8 | Vulnix