Name: CVE-2024-26482: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Creator: Rapid7
Published: 2024-02-22T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2024-26482, CWE-80, CVSS 7.1, EPSS 0.00035

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.

CVSS Details

CVSS 3.1 Base Score: 7.1
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Suse	—	Upgrade kernel-macrosUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade kernel-develUpgrade dtb-lgUpgrade dtb-mediatekUpgrade dtb-apmUpgrade reiserfs-kmp-defaultUpgrade dtb-amazonUpgrade kernel-default-extraUpgrade kernel-64kb-optionalUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-defaultUpgrade dtb-exynosUpgrade kernel-64kb-livepatch-develUpgrade dlm-kmp-64kbUpgrade dtb-xilinxUpgrade dtb-freescaleUpgrade kernel-debug-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-default-optionalUpgrade dtb-amlogicUpgrade kernel-kvmsmall-develUpgrade kernel-obs-qaUpgrade kselftests-kmp-64kbUpgrade dtb-amdUpgrade kernel-debugUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade kernel-default-develUpgrade dtb-armUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade kernel-default-livepatchUpgrade dtb-nvidiaUpgrade dtb-alteraUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-defaultUpgrade dtb-socionextUpgrade kernel-debug-vdsoUpgrade dtb-sprdUpgrade dtb-broadcomUpgrade reiserfs-kmp-64kbUpgrade dtb-marvellUpgrade dlm-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-caviumUpgrade dtb-renesasUpgrade kernel-default-vdsoUpgrade kernel-default-baseUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade kernel-docs-htmlUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-64kbUpgrade kernel-64kb-extraUpgrade dtb-qcomUpgrade cluster-md-kmp-64kbUpgrade kernel-kvmsmall-vdso	Jul 23, 2024	Feb 22, 2024

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence