CVE-2024-6528

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Schneider Electric	Modicon Controllers M241 / M251	All versions
Schneider Electric	Modicon Controllers M258 / LMC058	All versions
Schneider Electric	Modicon Controllers M262	All Versions

References

Timeline

Published: Jul 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-65297.1The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page,CVE-2024-65305.4A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior CVE-2024-65326.4The Sheet to Table Live Sync for Google Sheet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STWT_Sheet_CVE-2024-65335.4Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the appl CVE-2024-65344.3Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This CVE-2024-65355.3A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the CVE-2024-65365.4The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privileg CVE-2024-65385.3A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL t CVE-2024-65394.8A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the f CVE-2024-65405.3Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authoriz CVE-2024-65416.8The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This a CVE-2024-65426.5Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1.0p47, < 2.2.0p32 and < 2.3.0p11 allows a