CVE-2024-6881

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-68834.3The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings mCVE-2024-68845.4The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before outCVE-2024-68858.1The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insCVE-2024-688610.0Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git SerCVE-2024-68874.8The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, whicCVE-2024-68884.8The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whicCVE-2024-68894.8The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whicCVE-2024-68908.8Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation userCVE-2024-68918.8Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.CVE-2024-68926.1Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.CVE-2024-68937.5The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticatCVE-2024-68945.4The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insuffic
CVE-2024-6881: Medium severity, CVSS 5.4 | Vulnix