CVE-2024-44794

MediumCVSS 6.1

Published: 26/08/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

An XSS vulnerability in the /master/auth/OnedriveRedirect.php component of PicUploader (commit fcf82ea) allows attackers to inject malicious scripts or HTML via the error_description parameter.

Risk Assessment

Attackers can steal user sessions, redirect victims to malicious sites, or perform other actions in the victim's browser context, compromising data confidentiality and integrity.

Recommendation

Immediately update PicUploader to the latest version and apply output filtering/encoding for the error_description parameter.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.