CVE-2024-54001

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-540025.3Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Perfor CVE-2024-540038.0Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability CVE-2024-540044.3Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allo CVE-2024-540055.1A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions),CVE-2024-540067.2Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated re CVE-2024-540077.2Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated re CVE-2024-540087.2An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could al CVE-2024-540094.0Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited CVE-2024-54018.8Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-CVE-2024-540103.4A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjace CVE-2024-540116.5Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain req CVE-2024-540125.3Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing speci