CVE-2024-5415

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-541509.1cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, alCVE-2024-541517.5Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, wheCVE-2024-541529.3Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can wrCVE-2024-541536.5In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameterCVE-2024-541549.8In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandboxCVE-2024-541555.3In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authenticationCVE-2024-541566.5In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attackCVE-2024-541576.5In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detectorCVE-2024-541585.3In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encodingCVE-2024-541594.1stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.CVE-2024-54165.4The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url CVE-2024-541606.4dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sani