CVE-2024-40111

PoC ×2—

CVSS 3.1

4.8 medium

EPSS

<1%p56

Published

Aug 23, 2024 (Aug 23, 2024)

Modified

Jun 17, 2026

Description

A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum.

Vendors: automad
Products: automad
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.