CVE-2024-39311

Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core` rubygem, publisher on a `publify` application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link. A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator. Version 10.0.1 of Publify and version 10.0.2 of the `publify_core` rubygem fix the issue.

• CWE-79

• https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66qExploit, Vendor Advisory
• https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66qExploit, Vendor Advisory

Published

Mar 28, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39306Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-39307Kavita is a cross platform reading server. Opening an ebook …3.5
• CVE-2024-39308RailsAdmin is a Rails engine that provides an interface for …5.4
• CVE-2024-39309Parse Server is an open source backend that can be deployed …9.8
• CVE-2024-3931A vulnerability was found in Totara LMS up to 18.7. It has b…5.4
• CVE-2024-39310The Basil recipe theme for WordPress is vulnerable to Persis…5.4
• CVE-2024-39312Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-39313toy-blog is a headless content management system implementat…5.3
• CVE-2024-39314toy-blog is a headless content management system implementat…4.7
• CVE-2024-39315Pomerium is an identity and context-aware access proxy. Prio…6.5
• CVE-2024-39316Rack is a modular Ruby web server interface. Starting in ver…6.5
• CVE-2024-39317Wagtail is an open source content management system built on…4.9