CVE-2024-49378 MEDIUM

CVE-2024-49378: smartUp Cross-site Scripting vulnerability

Vendor Zimocode

Product smartup

Weakness CWE-79 · XSS

Published October 25, 2024

Last update October 25, 2024

View on NVD All CVEs

CVSS base score

5.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P

What the vulnerability does

01Description

smartUp, a web browser mouse gestures extension, has a universal cross-site scripting issue in the Edge and Firefox versions of smartUp 7.2.622.1170. The vulnerability allows another extension to execute arbitrary code in the context of the user’s tab. As of time of publication, no known patches exist.

Key dates

02Disclosure timeline

October 25, 2024 CVE published

October 25, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-49378 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-20367 Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise CVE-2024-49320 WordPress Encyclopedia / Glossary / Wiki plugin <= 1.7.60 - Cross Site Scripting (XSS) vulnerability CVE-2025-31804 WordPress Follow Us Badges plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability CVE-2026-20233 Cisco Webex Meetings Cross-Site Scripting Vulnerability CVE-2024-54183 IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting