CVE-2024-8004

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-80059.8A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file interna CVE-2024-80064.4Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one CVE-2024-80078.1A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an CVE-2024-80085.2A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages CVE-2024-80094.3The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page CVE-2024-80107.5The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a CVE-2024-80115.5Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions grante CVE-2024-80127.8An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local CVE-2024-80133.3A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted f CVE-2024-80148.8In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an i CVE-2024-80157.2In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injecti CVE-2024-80167.2The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deseriali