CVE-2024-58343

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-425

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
VisionHelpdesk< 5.6.10

References

Timeline

Published
Apr 16, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2024

CVE-2024-583446.4Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavCVE-2024-583489.8WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to uploaCVE-2024-583499.8WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious CVE-2024-58358.8Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in speciCVE-2024-583504.0Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleiCVE-2024-583519.8Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in botCVE-2024-583527.5Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entityCVE-2024-583538.9Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single bookCVE-2024-583549.9cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The wCVE-2024-583558.9Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https:/CVE-2024-583566.3SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined wiCVE-2024-583576.5SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called o
CVE-2024-58343: Medium severity, CVSS 4.3 | Vulnix