CVE-2024-44796

MediumCVSS 6.1

Published: 26/08/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in the /auth/AzureRedirect.php component of PicUploader (commit fcf82ea) allows attackers to inject arbitrary web scripts or HTML via the error_description parameter.

Risk Assessment

Attackers can steal user sessions, redirect victims to malicious sites, or perform other unauthorized actions in the victim's browser context, compromising data confidentiality and integrity.

Recommendation

Immediately update PicUploader to the latest version and apply output filtering and encoding for the error_description parameter to prevent script injection.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.