OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture.
References
| Link | Resource |
|---|---|
| https://github.com/thiagoralves/OpenPLC_v3/issues/242 | Exploit Issue Tracking |
| https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992 | Product |
| https://1d8.github.io/cves/cve_2024_37741/ | Exploit |
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Jul 2024, 14:27
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Openplcproject
Openplcproject openplc V3 Openplcproject openplc V3 Firmware |
|
| CWE | CWE-79 | |
| CPE | cpe:2.3:o:openplcproject:openplc_v3_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:openplcproject:openplc_v3:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | () https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992 - Product | |
| References | () https://github.com/thiagoralves/OpenPLC_v3/issues/242 - Exploit, Issue Tracking | |
| References | () https://1d8.github.io/cves/cve_2024_37741/ - Exploit |
28 Jun 2024, 13:38
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-28 13:15
Updated : 2024-07-03 14:27
NVD link : CVE-2024-37741
Mitre link : CVE-2024-37741
JSON object : View
Products Affected
openplcproject
- openplc_v3_firmware
- openplc_v3
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')