CVE-2024-5279

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component File Rename Handler. The manipulation with the input <img src="" onerror="alert(document.cookie)"> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266083.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 23, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-527917.5Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part o CVE-2024-527926.5LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In aff CVE-2024-527935.1The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` with `showDirListing:CVE-2024-527946.1Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is CVE-2024-527965.3Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In v CVE-2024-527977.5Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elas CVE-2024-527987.7path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be CVE-2024-527998.2Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessiv CVE-2024-52804.7The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca CVE-2024-528002.3veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transfo CVE-2024-528015.3sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The Op CVE-2024-528027.5RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in