CVE-2024-3851

A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploads. Attackers can exploit this vulnerability by uploading malicious HTML files, such as those containing JavaScript payloads, which are then executed in the context of the victim's session when accessed. This could lead to the execution of arbitrary JavaScript code in the context of the user's browser session, potentially resulting in phishing attacks or other malicious actions. The vulnerability affects the latest version of the repository.

• CWE-79
• CWE-79

• https://huntr.com/bounties/cae1a492-4e09-4d56-8e11-17703bdfe653Exploit, Issue Tracking, Third Party Advisory
• https://huntr.com/bounties/cae1a492-4e09-4d56-8e11-17703bdfe653Exploit, Issue Tracking, Third Party Advisory

Published

May 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-38504In JetBrains YouTrack before 2024.2.34646 the Guest User Acc…5.3
• CVE-2024-38505In JetBrains YouTrack before 2024.2.34646 user access token …7.5
• CVE-2024-38506In JetBrains YouTrack before 2024.2.34646 user without appro…8.1
• CVE-2024-38507In JetBrains Hub before 2024.2.34646 stored XSS via project …5.4
• CVE-2024-38508A privilege escalation vulnerability was discovered in the w…7.2
• CVE-2024-38509A privilege escalation vulnerability was discovered in XCC t…7.2
• CVE-2024-38510A privilege escalation vulnerability was discovered in the S…7.2
• CVE-2024-38511A privilege escalation vulnerability was discovered in an up…7.2
• CVE-2024-38512A privilege escalation vulnerability was discovered in XCC t…7.2
• CVE-2024-38513Fiber is an Express-inspired web framework written in Go A v…9.8
• CVE-2024-38514NextChat is a cross-platform ChatGPT/Gemini UI. There is a S…7.4
• CVE-2024-38515Rejected reason: This CVE is a duplicate of CVE-2024-38374.