CVE-2024-41572

Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user credentials or execute actions such as injecting malicious scripts or redirecting users to malicious sites.

• CWE-79
• CWE-79

• https://medium.com/%40ChadSecurity/cve-2024-41572-68397fae354bThird Party Advisory

Published

Aug 21, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41551CampCodes Supplier Management System v1.0 is vulnerable to S…9.8
• CVE-2024-4156The Essential Addons for Elementor – Best Elementor Template…5.4
• CVE-2024-41564EMI v.1.1.10 and before, fixed in v.1.1.11, contains an Impr…5.3
• CVE-2024-41565JustEnoughItems (JEI) 19.5.0.33 and before contains an Impro…5.3
• CVE-2024-4157The Contact Form Plugin by Fluent Forms for Quiz, Survey, an…8.8
• CVE-2024-41570An Unauthenticated Server-Side Request Forgery (SSRF) in dem…9.8
• CVE-2024-41577An arbitrary file upload vulnerability in the Ueditor compon…9.8
• CVE-2024-41579DTStack Taier 1.4.0 allows remote attackers to specify the j…9.8
• CVE-2024-4158The Blocksy theme for WordPress is vulnerable to Stored Cros…5.4
• CVE-2024-41583DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to …4.7
• CVE-2024-41584DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to …4.7
• CVE-2024-41585DrayTek Vigor3910 devices through 4.3.2.6 are affected by an…6.8