CVE-2024-6019 — Cross-site Scripting in Music Request Manager

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
1.1%
top 21.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Scriptonite Music Request Manager
Timeline
PublishedSep 12

Description

The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
CVEList
Music Request Manager <= 1.3 - Unauthenticated Stored XSS↗2024-09-12
▶
GHSA
GHSA-6x3x-mhgp-4j2c: The Music Request Manager WordPress plugin through 1↗2024-09-12
▶

💥Exploits & PoCs

1
Exploit-DB
Ray OS v2.6.3 - Command Injection RCE(Unauthorized)↗2024-04-12
▶
CVE-2024-6019 — Cross-site Scripting | cvebase