CVE-2024-7644

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Leads Manager Tool 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/add-leads.php of the component Add Leads Handler. The manipulation of the argument leads_name/phone_number leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Leads Manager Tool	1.0
sourcecodester	leads_manager_tool	1.0

References

https://github.com/joinia/webray.com.cn/blob/main/Leads-Manager-Tool/leadmanagerxss.mdExploit
https://vuldb.com/?ctiid.274065Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.274065Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?submit.387345Third Party Advisory, VDB Entry
https://www.sourcecodester.com/

Timeline

Published: Aug 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-76455.4A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability a CVE-2024-76468.8A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `ex CVE-2024-76476.1The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.CVE-2024-76484.3The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the CVE-2024-76496.1The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and in CVE-2024-76506.3Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The vu CVE-2024-76517.5The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-bu CVE-2024-76527.5An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory c CVE-2024-76546.1An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was a CVE-2024-76554.8The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Sc CVE-2024-76568.8The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deseri CVE-2024-76575.4A vulnerability classified as problematic was found in Gila CMS 1.10.9. This vulnerability affects unknown code of the file /cm/update_rows/