CVE-2024-6429

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.

By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-451

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-64318.8The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capab CVE-2024-64325.4The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within CVE-2024-64337.5The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by pr CVE-2024-64344.3The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, a CVE-2024-64358.8A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access func CVE-2024-64366.5An input validation vulnerability exists in the Rockwell Automation Sequence Manager™ which could allow a malicious user to send malformed p CVE-2024-64375.8On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based ro CVE-2024-64386.5A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderCo CVE-2024-64399.8A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some CVE-2024-64409.8A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an CVE-2024-64416.3A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality CVE-2024-64426.5In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.