Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-41350

Good to know:

icon

Date: August 28, 2024

bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php

Language: PHP

Severity Score

Related Resources (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-41350
https://github.com/xjzzzxx/vulFound/blob/main/bjyadmin/xss2.md
https://github.com/baijunyao/thinkphp-bjyadmin
https://www.mend.io/vulnerability-database/CVE-2024-41350

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

icon

Upgrade Version

Upgrade to version hoter/yii2-umeditor - no_fix;tiderjian/think-core - v2.3.5;tiderjian/think-core - v11.13.4;tiderjian/think-core - dev-dependabot/npm_and_yarn/asset/libs/label-select/ajv-6.12.6;tiderjian/think-core - v11.30.4;tiderjian/think-core - v11.34.0;tiderjian/think-core - v11.19.10;tiderjian/think-core - v11.30.0;tiderjian/think-core - dev-dependabot/npm_and_yarn/asset/libs/label-select/tar-4.4.19;tiderjian/think-core - v7.2.0;tiderjian/think-core - v8.0.1;tiderjian/think-core - v11.13.10;tiderjian/think-core - v7.0.1;tiderjian/think-core - v11.13.6;tiderjian/think-core - v13.0.0;tiderjian/think-core - dev-dependabot/npm_and_yarn/asset/libs/label-select/postcss-7.0.36;tiderjian/think-core - v11.34.7;tiderjian/think-core - v12.0.5;tiderjian/think-core - v11.33.4;tiderjian/think-core - v12.0.8;tiderjian/think-core - v8.0.4;tiderjian/think-core - v3.1.2;tiderjian/think-core - dev-dependabot/npm_and_yarn/asset/libs/label-select/ssri-6.0.2;tiderjian/think-core - v11.34.3;tiderjian/think-core - v12.0.0;tiderjian/think-core - v11.x-dev;logtous/layui_admin_panel - no_fix;tiderjian/qscmf - dev-rebuild1;tiderjian/qscmf - v2.0.0;zhanghong/tpadmin - no_fix;jianzi/runcms - no_fix;youwen/bauth - no_fix;moxuandi/yii2-umeditor - no_fix;moxuandi/yii2-umeditor - v2.0.0;xwh/smkpush-laravel - no_fix;danpai888/tpadmin - no_fix;io/fe - v0.0.1;cgbin/cgblog - no_fix;wanghaipengture/dabai - no_fix;rogeecn/yii2-ueditor - no_fix;yuemanyueman/composer156 - no_fix

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us