CVE-2024-53386

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-94 CWE-79

Affected software

Vendor	Product	Versions
Piqnt	Stage.js	<= 0.8.10

References

https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534Exploit, Third Party Advisory
https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159Product
https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534Exploit, Third Party Advisory

Timeline

Published: Mar 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-533878.8A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element.CVE-2024-533888.8A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.CVE-2024-53397.2A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown fu CVE-2024-53407.2A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionali CVE-2024-534068.8Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reu CVE-2024-534073.3In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote cont CVE-2024-534085.4AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2024-53415.4The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of CVE-2024-534128.4Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achie CVE-2024-53425.4The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sips_popup' shortcode i CVE-2024-534235.6An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets.CVE-2024-534256.2A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing