CVEvulnerability
CVE-2024-50637
5.4 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2024-11-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L
- Weaknesses
- CWE-79
Description
UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which can be used to steal cookies.
Affected configurations
• webkul unopim (< 0.1.4)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/unopim/unopim/issues/41 Issue Tracking, Vendor Advisory
- https://github.com/unopim/unopim/releases/tag/v0.1.4 Release Notes
- https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md Exploit, Third Party Advisory