CVE-2024-56918

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/netbox-community/netbox/releases/tag/v4.1.7Release Notes
https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56918Third Party Advisory
https://youtu.be/GC8-PUlu2i8?si=cd_dSVno93pCisr-&t=103Exploit
https://youtu.be/zBbjNNK79pgPermissions Required

Timeline

Published: Jun 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-56926.5On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed ext CVE-2024-569217.5An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect err CVE-2024-569235.4Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6 CVE-2024-569247.3A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary J CVE-2024-56936.1Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of sa CVE-2024-569385.4LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.CVE-2024-569395.4LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.CVE-2024-56947.5An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vu CVE-2024-569407.5An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file upl CVE-2024-569465.3Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting CVE-2024-569476.5An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a c CVE-2024-569486.5An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted l