CVE-2024-56508

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a file upload vulnerability exists in the LinkAce. This issue occurs in the "Import Bookmarks" functionality, where malicious HTML files can be uploaded containing JavaScript payloads. These payloads execute when the uploaded links are accessed, leading to potential reflected or persistent XSS scenarios. This vulnerability is fixed in 1.15.6.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Dec 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-565098.6changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper inpu CVE-2024-56518.8A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying CVE-2024-565105.3@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v CVE-2024-565119.8DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.CVE-2024-565125.4Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and CVE-2024-565138.7Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds.CVE-2024-565145.3Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds.CVE-2024-565156.5Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (th CVE-2024-565166.9free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions u CVE-2024-565175.3LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cro CVE-2024-565189.8Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML docum CVE-2024-565197.5An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.