CVE-2024-1707

A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jsp#settings of the component Software Update Handler. The manipulation of the argument Reference leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254397 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-79

• https://drive.google.com/file/d/1spsElvU8rgCs4gUxc662SCBjTI9VAqth/viewExploit
• https://github.com/strik3r0x1/Vulns/blob/main/GARO_GLBDCMB-T274WO_Stored_XSS.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.254397Permissions Required
• https://vuldb.com/?id.254397Third Party Advisory
• https://drive.google.com/file/d/1spsElvU8rgCs4gUxc662SCBjTI9VAqth/viewExploit
• https://github.com/strik3r0x1/Vulns/blob/main/GARO_GLBDCMB-T274WO_Stored_XSS.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.254397Permissions Required
• https://vuldb.com/?id.254397Third Party Advisory

Published

Feb 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1701A vulnerability has been found in keerti1924 PHP-MYSQL-User-…9.8
• CVE-2024-1702A vulnerability was found in keerti1924 PHP-MYSQL-User-Login…9.8
• CVE-2024-1703A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It h…5.3
• CVE-2024-1704A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It h…8.1
• CVE-2024-1705A vulnerability was found in Shopwind up to 4.6. It has been…8.1
• CVE-2024-1706A vulnerability was determined in ZKTeco ZKBio Access IVS up…5.4
• CVE-2024-1708ConnectWise ScreenConnect 23.9.7 and prior are affected by p…8.4
• CVE-2024-1709ConnectWise ScreenConnect 23.9.7 and prior are affected by a…10
• CVE-2024-1710The Addon Library plugin for WordPress is vulnerable to unau…8.8
• CVE-2024-1711The Create by Mediavine plugin for WordPress is vulnerable t…9.8
• CVE-2024-1712The Carousel Slider WordPress plugin before 2.2.7 does not s…4.7
• CVE-2024-1713A user who can create objects in a database with plv8 3.2.1 …7.2