Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user credentials or execute actions such as injecting malicious scripts or redirecting users to malicious sites.
References
| Link | Resource |
|---|---|
| https://medium.com/%40ChadSecurity/cve-2024-41572-68397fae354b | Third Party Advisory |
Configurations
History
11 Sep 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Sep 2024, 17:02
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:lang-learn-guy:learning_with_texts:2.0.3:*:*:*:*:*:*:* | |
| CWE | CWE-79 | |
| First Time |
Lang-learn-guy learning With Texts
Lang-learn-guy |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | () https://drive.google.com/drive/folders/12NAfZ2VrMvJug1JVSzfz9PwCuttnlwzP - Broken Link | |
| References | () https://medium.com/%40ChadSecurity/cve-2024-41572-68397fae354b - Third Party Advisory |
22 Aug 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user credentials or execute actions such as injecting malicious scripts or redirecting users to malicious sites. |
21 Aug 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-21 19:15
Updated : 2025-03-18 19:15
NVD link : CVE-2024-41572
Mitre link : CVE-2024-41572
JSON object : View
Products Affected
lang-learn-guy
- learning_with_texts
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')