CVE-2024-52794

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-527965.3Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In v CVE-2024-527977.5Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elas CVE-2024-527987.7path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be CVE-2024-527998.2Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessiv CVE-2024-52804.7The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca CVE-2024-528002.3veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transfo CVE-2024-528015.3sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The Op CVE-2024-528027.5RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in CVE-2024-528039.8LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the CVE-2024-528047.5Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior CVE-2024-528057.5Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transient CVE-2024-528068.3SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAML