CVE-2024-56507: fallo de gravedad media en Kovah LinkAce
Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.6epss 0.3%
LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting (XSS) vulnerability exists in the LinkAce. This issue occurs in the "URL" field of the "Edit Link" module, where user input is not properly sanitized or encoded before being reflected in the HTML response. This allows attackers to inject and execute arbitrary JavaScript in the context of the victim’s browser, leading to potential session hijacking, data theft, and unauthorized actions. This vulnerability is fixed in 1.15.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Productos afectados
Kovah · LinkAceCVEs relacionadas — Kovah LinkAce
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-45344HIGHLinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instancesEPSS 0.5%CVE-2024-56508HIGHFile Upload Vulnerability Leading to XSS in LinkAce v1.15.5EPSS 0.4%CVE-2025-62720HIGHLinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private LinksEPSS 0.4%CVE-2025-62721HIGHLinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and TagsEPSS 0.4%CVE-2026-49436HIGHLinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link APIEPSS 0.4%CVE-2025-59424HIGHLinkAce Vulnerable to Stored XSS on the Audit PageEPSS 0.4%