CVE-2024-57776

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gitee.com/r1bbit/JFinalOA/issues/IBHUS8Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jan 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-577775.1Directory Traversal vulnerability in Ianproxy v.0.1 and before allows a remote attacker to obtain sensitive information CVE-2024-577788.8An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from st CVE-2024-577826.8An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service.CVE-2024-577838.1The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to th CVE-2024-577845.5An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal.CVE-2024-577854.9Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.CVE-2024-577905.4IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile fla CVE-2024-577917.5In the Linux kernel, the following vulnerability has been resolved: net/smc: check return value of sock_recvmsg when draining clc data Whe CVE-2024-577927.8In the Linux kernel, the following vulnerability has been resolved: power: supply: gpio-charger: Fix set charge current limits Fix set cha CVE-2024-577935.5In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CVE-2024-577957.8In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Remove the direct link to net_device The similar patch in si CVE-2024-577987.8In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up