CVE-2024-55341

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-553424.7A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This P CVE-2024-55359.1Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or m CVE-2024-553548.8Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism fai CVE-2024-55365.4The GamiPress – Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link shortcode in all vers CVE-2024-553719.8Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uplo CVE-2024-553729.8Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by CVE-2024-553745.3REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.CVE-2024-55399.2The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor t CVE-2024-553986.54C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.CVE-2024-553996.54C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).CVE-2024-55406.9The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allo CVE-2024-554016.5An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.