CVE-2024-5385

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, has been found in oretnom23 Online Car Wash Booking System 1.0. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name with the input <script>confirm (document.cookie)</script> leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-266303.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
oretnom23	Online Car Wash Booking System	1.0

References

https://vuldb.com/?ctiid.266303Permissions Required
https://vuldb.com/?id.266303Third Party Advisory, VDB Entry
https://vuldb.com/?submit.344504Third Party Advisory, VDB Entry
https://vuldb.com/?ctiid.266303Permissions Required
https://vuldb.com/?id.266303Third Party Advisory, VDB Entry
https://vuldb.com/?submit.344504Third Party Advisory, VDB Entry

Timeline

Published: May 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-538508.2The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.CVE-2024-538516.5Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs was CVE-2024-538554.3Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis o CVE-2024-538567.5rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. T CVE-2024-538577.5rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp CVE-2024-538586.5The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentica CVE-2024-538597.5go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been ident CVE-2024-53868.8In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role CVE-2024-538608.6sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the CVE-2024-538617.5pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being acc CVE-2024-538627.5Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=cli CVE-2024-538639.1Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a spec