CVE-2024-41676

Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.

• CWE-79
• CWE-79

• https://github.com/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948Issue Tracking
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5vrp-638w-p8m2Mitigation, Vendor Advisory
• https://github.com/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948Issue Tracking
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5vrp-638w-p8m2Mitigation, Vendor Advisory

Published

Jul 29, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41670In the module "PayPal Official" for PrestaShop 7+ releases p…7.5
• CVE-2024-41671Twisted is an event-based framework for internet application…8.3
• CVE-2024-41672DuckDB is a SQL database management system. In versions 1.0.…7.5
• CVE-2024-41673Decidim is a participatory democracy framework. The version …7.1
• CVE-2024-41674CKAN is an open-source data management system for powering d…5.3
• CVE-2024-41675CKAN is an open-source data management system for powering d…6.1
• CVE-2024-41677Qwik is a performance focused javascript framework. A potent…6.1
• CVE-2024-41678GLPI is a free asset and IT management software package. An …6.1
• CVE-2024-41679GLPI is a free asset and IT management software package. An …8.8
• CVE-2024-4168A vulnerability was found in Tenda 4G300 1.01.42. It has bee…8.8
• CVE-2024-41681A vulnerability has been identified in Location Intelligence…7.5
• CVE-2024-41682A vulnerability has been identified in Location Intelligence…5.3