CVE-2024-5405 MEDIUM

CVE-2024-5405: Multiple vulnerabilities in WinNMP from Wtriple

Vendor Wtriple

Product WinNMP

Weakness CWE-79 · XSS

Published May 27, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details.

Key dates

02Disclosure timeline

May 27, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-5405 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-9346 Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-54358 WordPress 3D Avatar User Profile plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-2526 MAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php cross site scripting CVE-2025-69017 WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability CVE-2024-51916 WordPress Multifox Plus plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability