CVE-2024-44795
A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitr
CVSS
6.1
Medium
EPSS
0.3%
p22
KEV
—
Exploit Today
7
0-100
Published: Aug 26, 2024 · Last modified: Jul 5, 2026 · CWE-79
0.3%EPSS · 30 days0.3%
2026-08-102026-09-07
A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-818244.7 MED—
———The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.5hCVE-2026-696904.6 MED—
———Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.5hCVE-2026-696153.5 LOW—
———Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.5hCVE-2026-694177.3 HIG—
———Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.5hCVE-2026-694027.3 HIG—
———Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.5hCVE-2026-693569.3 CRI—
———Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.5h