CVE-2024-6050

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects SOWA OPAC software in versions from 4.0 before 4.9.10, from 5.0 before 6.2.12.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SOKRATES-software	SOWA OPAC	>= 4.0, < 4.9.10; >= 5.0, < 6.2.12
sokrates	sowa_opac	>= 4.0, < 4.9.10; >= 5.0, < 6.2.12

References

https://cert.pl/en/posts/2024/07/CVE-2024-6050/Third Party Advisory
https://cert.pl/posts/2024/07/CVE-2024-6050/Third Party Advisory
https://cert.pl/en/posts/2024/07/CVE-2024-6050/Third Party Advisory
https://cert.pl/posts/2024/07/CVE-2024-6050/Third Party Advisory

Timeline

Published: Jul 1, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-60514.3Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate th CVE-2024-60525.4Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HT CVE-2024-60534.3Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior CVE-2024-60548.8The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post CVE-2024-60554.7Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Win CVE-2024-60565.3A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknow CVE-2024-60579.8Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that CVE-2024-60586.1A vulnerability classified as problematic has been found in LabVantage LIMS 2017. This affects an unknown part of the file /labvantage/rc?co CVE-2024-60594.8A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown proces CVE-2024-60609.3An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP req CVE-2024-60615.5A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the CVE-2024-60625.5A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf