CVE-2024-4754 MEDIUM

CVE-2024-4754: Stored XSS in Next4Biz's BPM

Vendor Next4Biz Crm & Bpm Software
Product Business Process Manangement (BPM)
Weakness CWE-79 · XSS
Published June 24, 2024
Last update June 3, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Stored XSS. This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.

Key dates

02Disclosure timeline

June 24, 2024 CVE published
June 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-1449 Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-24927 WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS) CVE-2025-13367 User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2024-12441 BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting CVE-2022-40311 WordPress Analytics Cat plugin <= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability