CVE-2024-10099

A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the `/api/upload/image` endpoint. The payload is executed when the file is viewed through the `/view` API endpoint, leading to potential execution of arbitrary JavaScript code.

• CWE-79

• https://huntr.com/bounties/14fb8c9a-692a-4d8c-b4b2-24c6f91a383cExploit, Third Party Advisory

Published

Oct 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10093A vulnerability, which was classified as critical, was found…7.8
• CVE-2024-10094Pega Platform versions 6.x to Infinity 24.1.1 are affected b…9.8
• CVE-2024-10095In Progress Telerik UI for WPF versions prior to 2024 Q4 (20…9.8
• CVE-2024-10096Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-10097The Loginizer Security and Loginizer plugins for WordPress a…8.1
• CVE-2024-10098The ApplyOnline WordPress plugin before 2.6.3 does not prot…2.7
• CVE-2024-1010A vulnerability classified as problematic has been found in …5.4
• CVE-2024-10100A path traversal vulnerability exists in binary-husky/gpt_ac…7.5
• CVE-2024-10101A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2024-10102The Photo Gallery, Images, Slider in Rbs Image Gallery WordP…2.7
• CVE-2024-10103In the process of testing the MailPoet WordPress plugin bef…6.1
• CVE-2024-10104The Jobs for WordPress plugin before 2.7.8 does not sanitise…5.9