CVE-2024-58344

MEDIUM

6.4

Beschreibung

Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.

CVE Details

CVSS v3.1 Bewertung6.4

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht4/22/2026

Zuletzt geandert4/22/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-79

Referenzen

https://github.com/lincanbin/Carbon-Forum(disclosure@vulncheck.com)

https://www.94cb.com/(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/52043(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/carbon-forum-persistent-xss-via-forum-name-field(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.