PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2024-52597] Stored Cross-Site Scripting (XSS) in 2FAuth

xbow.com | vulnerability | CVE-2024-52597 | #vulnerability-research | #open-source | #xss | #svg-upload | #2fauth | #cve-2024-52597
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Documents how XBOW reached stored XSS in 2FAuth (CVE-2024-52597) through SVG uploads in the QR-code decoder, after working around authentication, and validated it in a headless browser.
CVE
CVE-2024-52597
Published
Collected

Related coverage

vulnerability · horizon3.ai
[CVE-2020-35124] Unauthenticated XSS to Remote Code Execution Chain in Mautic < 3.2.4
# Unauthenticated XSS to Remote Code Execution Chain in Mautic ` page. Below we dump the contents of the `/etc/passwd` file on the Mautic server. And upgrading to a reverse shell using a Python...
vulnerability · xbow.com
SSRF & URI Validation Bypass in 2FAuth
XBOW's first 2FAuth report: an SSRF (CVE-2024-52598) in the OTP preview feature that bypasses MIME filtering to reach internal targets such as cloud metadata services.
vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
vulnerability · bishopfox.com
FileStack Upload Advisory
A FileStack advisory describing a cross-site scripting flaw: JavaScript embedded in uploaded SVG files executes in the cdn.filestackcontent.com origin; mitigations include CSP and sandboxing.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · slcyber.io
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)
The research team releases an open source tool php2shell-scanner which contains a high fidelity scanning mechanism to check for CVE-2026-109618 and CVE-2026-109619 across hosts.
Back