CVE-2024-53279

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
SynologySynology Router Manager (SRM)>= 1.3, < 1.3.1-9346-10

References

Timeline

Published
Dec 9, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-53289.3A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint '/auth/saml/CVE-2024-532805.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionalCVE-2024-532815.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology CVE-2024-532825.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality CVE-2024-532835.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in SCVE-2024-532845.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in CVE-2024-532855.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology CVE-2024-532867.2Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in SynCVE-2024-532875.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology CVE-2024-532885.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology RCVE-2024-532897.0Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local acCVE-2024-53298.8The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘da
CVE-2024-53279: Medium severity, CVSS 5.9 | Vulnix