CVE-2024-8521

A vulnerability, which was classified as problematic, was found in Wavelog up to 1.8.0. Affected is the function index of the file /qso of the component Live QSO. The manipulation of the argument manual leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.1 is able to address this issue. The patch is identified as b31002cec6b71ab5f738881806bb546430ec692e. It is recommended to upgrade the affected component.
Configurations

Configuration 1 (hide)

cpe:2.3:a:wavelog:wavelog:*:*:*:*:*:*:*:*

History

04 Jun 2025, 16:56

Type Values Removed Values Added
References () https://github.com/GithubUser843205/CVEs/tree/main/CVE-2024-8521 - () https://github.com/GithubUser843205/CVEs/tree/main/CVE-2024-8521 - Exploit
References () https://github.com/wavelog/wavelog/commit/b31002cec6b71ab5f738881806bb546430ec692e - () https://github.com/wavelog/wavelog/commit/b31002cec6b71ab5f738881806bb546430ec692e - Patch
References () https://github.com/wavelog/wavelog/pull/744 - () https://github.com/wavelog/wavelog/pull/744 - Issue Tracking
References () https://github.com/wavelog/wavelog/releases/tag/1.8.1 - () https://github.com/wavelog/wavelog/releases/tag/1.8.1 - Release Notes
References () https://vuldb.com/?ctiid.276726 - () https://vuldb.com/?ctiid.276726 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.276726 - () https://vuldb.com/?id.276726 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.399819 - () https://vuldb.com/?submit.399819 - Third Party Advisory, VDB Entry
First Time Wavelog
Wavelog wavelog
CPE cpe:2.3:a:wavelog:wavelog:*:*:*:*:*:*:*:*

09 Sep 2024, 13:03

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-07 08:15

Updated : 2025-06-04 16:56


NVD link : CVE-2024-8521

Mitre link : CVE-2024-8521

CVE.ORG link : CVE-2024-8521


JSON object : View

Products Affected

wavelog

  • wavelog
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')