Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

PicUploader: Hackers can inject malicious code through Azure login page

CVE-2024-44796 · published 2 years ago
Summary

A security flaw in PicUploader's login page allows attackers to inject malicious code into the page, potentially stealing user data or taking control of accounts. This affects users who have the PicUploader plugin installed. To fix this issue, update to the latest version of PicUploader to ensure the security flaw is patched.

What to do
  • Update xiebruce picuploader to version 2024-02-13 or later.
Affected software
VendorProductAffected versions
xiebruce picuploader < 2024-02-13
cpe:2.3:a:xiebruce:picuploader:*:*:*:*:*:*:*:*
Original advisory text
A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj...
A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 Aug 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-44796 · NVD
CVE-2024-44796 · MITRE
Track software like this
Free during beta