CVE-2024-8411

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8411
A vulnerability was determined in ABCD ABCD2 up to 2.2.0-beta-1. Impacted is an unknown function of the file /buscar_integrada.php. Executing a manipulation of the argument Sub_Expresion can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The developer explains, that "this script has been completely redesigned after this version".

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/peritocibernetico/ABCD_Vulnerabilities Exploit
https://vuldb.com/?ctiid.276491 Permissions Required
https://vuldb.com/?id.276491 Permissions Required Third Party Advisory
https://vuldb.com/?submit.398843 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:abcd-community:abcd:2.2.0:alpha:*:*:*:*:*:*
cpe:2.3:a:abcd-community:abcd:2.2.0:beta0:*:*:*:*:*:*
History

26 Feb 2026, 19:28

Type Values Removed Values Added
Summary (en) A vulnerability, which was classified as problematic, has been found in ABCD ABCD2 up to 2.2.0-beta-1. This issue affects some unknown processing of the file /buscar_integrada.php. The manipulation of the argument Sub_Expresion leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability was determined in ABCD ABCD2 up to 2.2.0-beta-1. Impacted is an unknown function of the file /buscar_integrada.php. Executing a manipulation of the argument Sub_Expresion can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The developer explains, that "this script has been completely redesigned after this version".
CWE CWE-94
CVSS v2 : 4.0
v3 : 4.3 		v2 : 4.0
v3 : 3.5

05 Sep 2024, 14:19

Type Values Removed Values Added
CVSS v2 : 4.0
v3 : 3.5 		v2 : 4.0
v3 : 4.3
References () https://github.com/peritocibernetico/ABCD_Vulnerabilities - () https://github.com/peritocibernetico/ABCD_Vulnerabilities - Exploit
References () https://vuldb.com/?ctiid.276491 - () https://vuldb.com/?ctiid.276491 - Permissions Required
References () https://vuldb.com/?id.276491 - () https://vuldb.com/?id.276491 - Permissions Required, Third Party Advisory
References () https://vuldb.com/?submit.398843 - () https://vuldb.com/?submit.398843 - Third Party Advisory, VDB Entry
Summary
  • (es) Se ha encontrado una vulnerabilidad clasificada como problemática en ABCD ABCD2 hasta la versión 2.2.0-beta-1. Este problema afecta a algunos procesos desconocidos del archivo /buscar_integrada.php. La manipulación del argumento Sub_Expresion provoca cross site scripting. El ataque puede iniciarse de forma remota. El exploit se ha hecho público y puede utilizarse. Se contactó primeramente con el proveedor sobre esta revelación, pero no respondió de ninguna manera.
First Time Abcd-community
Abcd-community abcd
CPE cpe:2.3:a:abcd-community:abcd:2.2.0:beta0:*:*:*:*:*:*
cpe:2.3:a:abcd-community:abcd:2.2.0:alpha:*:*:*:*:*:*

04 Sep 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-04 15:15

Updated : 2026-02-26 19:28

NVD link : CVE-2024-8411

Mitre link : CVE-2024-8411

CVE.ORG link : CVE-2024-8411

JSON object : View

Products Affected

abcd-community

  • abcd
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')