CVE-2024-45699

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 2, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-45705.4The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, anCVE-2024-457006.5Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests CVE-2024-457095.5SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on LinuxCVE-2024-457107.8SolarWinds Platform is susceptible to an Uncontrolled Search Path Element Local Privilege Escalation vulnerability. This requires a low privCVE-2024-457118.8SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges givCVE-2024-457125.4SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. The vulnerability can only be performed by an autCVE-2024-457134.4SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleCVE-2024-457144.1Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payloCVE-2024-457155.2The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements.CVE-2024-457174.8The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. TCVE-2024-457184.6Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged accouCVE-2024-457192.6Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using th