CVE-2022-24710mediumCWE-79

CVE-2022-24710: fallo de gravedad media en WeblateOrg weblate

Cross-site Scripting in Weblate

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear weblate+ Monitorear weblate

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.8%
Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
WeblateOrg · weblate
CVEs relacionadas — WeblateOrg weblate

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-68398CRITICALWeblate has git config file overwrite vulnerability that leads to remote code executionEPSS 0.8%CVE-2026-33435HIGHWeblate: Remote code execution during backup restorationEPSS 0.7%CVE-2026-61792HIGHWeblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)EPSS 0.6%CVE-2026-24126MEDIUMWeblate has an argument injection in management consoleEPSS 0.5%CVE-2026-62326MEDIUMWeblate Has Uncontrolled Resource Consumption viaEPSS 0.5%CVE-2026-34242HIGHWeblate: Arbitrary File Read via SymlinkEPSS 0.5%