CVE-2024-36819

MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee dashboards, resulting in unauthorized script execution whenever the dashboard is loaded.

• CWE-79

• https://github.com/RamonSilva20/mapos/commit/3559bae4782162faab94670f503fd35b0f331929Patch
• https://github.com/RamonSilva20/mapos/tree/masterProduct
• https://github.com/RamonSilva20/mapos/commit/3559bae4782162faab94670f503fd35b0f331929Patch
• https://github.com/RamonSilva20/mapos/tree/masterProduct

Published

Jun 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36800A SQL injection vulnerability in SEMCMS v.4.8, allows a remo…7.5
• CVE-2024-36801A SQL injection vulnerability in SEMCMS v.4.8, allows a remo…5.9
• CVE-2024-36802Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-3681The Interactive World Maps plugin for WordPress is vulnerabl…6.1
• CVE-2024-36811Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-36814An arbitrary file read vulnerability in Adguard Home before …4.9
• CVE-2024-3682The WP STAGING and WP STAGING Pro plugins for WordPress are …5.3
• CVE-2024-36821Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.1…6.8
• CVE-2024-36823The encrypt() function of Ninja Core v7.0.0 was discovered t…7.5
• CVE-2024-36827An XML External Entity (XXE) vulnerability in the ebookmeta.…7.5
• CVE-2024-36829Incorrect access control in Teldat M1 v11.00.05.50.01 allows…7.5
• CVE-2024-36831A NULL pointer dereference in the plugins_call_handle_uri_cl…5.3