CVE-2024-47075

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., `img` tags with unsanitized `name` attributes) are present. Version 2.9.17 fixes this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-470768.6CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` p CVE-2024-470776.5authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stole CVE-2024-470789.8Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a sh CVE-2024-470796.4Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an CVE-2024-47089.8mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.CVE-2024-470808.7matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the m CVE-2024-470815.3Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for s CVE-2024-470828.0Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL CVE-2024-470837.5Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an is CVE-2024-470848.3Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where t CVE-2024-470856.5This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters (cCdslClicentcode and cLdClien CVE-2024-470866.5This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpo