CVE-2024-29644
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability exists in dcat-admin version 2.1.3 and earlier. A remote attacker can inject a malicious script via the user login box to execute arbitrary code.
Risk Assessment
An attacker could hijack an administrator session, steal credentials, or spread malware within the organization.
Recommendation
Immediately upgrade dcat-admin to a version later than 2.1.3 and apply input filtering on the login field.
Other vulnerabilities in dcat-admin
See all- CVE-2026-11621Medium
Dcat-Admin up to version 2.2.3-beta has a vulnerability in the editorMDUpload function on the user settings page. Manipulation of the editormd-image-file argument leads to unrestricted file upload. The attack can be remote.
- CVE-2023-33736Medium
Dcat-Admin v2.1.3-beta has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
Original NVD description (English source)
Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login box.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS