CVE-2024-5406 MEDIUM

CVE-2024-5406: Multiple vulnerabilities in WinNMP from Wtriple

Vendor Wtriple
Product WinNMP
Weakness CWE-79 · XSS
Published May 27, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details.

Key dates

02Disclosure timeline

May 27, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-3904 Cross-site Scripting (XSS) - Stored in getgrav/grav CVE-2024-6261 Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVE-2024-9449 Auto iFrame <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter CVE-2024-54290 WordPress Role Includer plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-27969 WordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerability