CVE-2024-4754

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Stored XSS.

This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-475409.8GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identifi CVE-2024-475417.5GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the gst_ssa_p CVE-2024-475427.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2_rea CVE-2024-475437.5GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_CVE-2024-475447.5GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a n CVE-2024-475457.5GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak fu CVE-2024-475467.5GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data CVE-2024-475479.8Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which lea CVE-2024-475496.1Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP re CVE-2024-47554.8The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2024-475506.7Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escal CVE-2024-475529.8Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0