CVE-2024-51989

Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability was identified in the PasswordPusher application, affecting versions `v1.41.1` through and including `v.1.48.0`. The issue arises from an un-sanitized parameter which could allow attackers to inject malicious JavaScript into the application. Users who self-host and have the login system enabled are affected. Exploitation of this vulnerability could expose user data, access to user sessions or take unintended actions on behalf of users. To exploit this vulnerability, an attacker would need to convince a user to click a malicious account confirmation link. It is highly recommended to update to version `v1.48.1` or later to mitigate this risk. There are no known workarounds for this vulnerability. ### Solution Update to version `v1.48.1` or later where input sanitization has been applied to the account confirmation process. If updating is not immediately possible,

• CWE-79

• https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-5chg-cq29-gfqf

Published

Nov 7, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51981An unauthenticated attacker may perform a blind server side …5.3
• CVE-2024-51982An unauthenticated attacker who can connect to TCP port 9100…7.5
• CVE-2024-51983An unauthenticated attacker who can connect to the Web Servi…7.5
• CVE-2024-51984An authenticated attacker can reconfigure the target device …6.8
• CVE-2024-51987Duende.AccessTokenManagement.OpenIdConnect is a set of .NET …5.4
• CVE-2024-51988RabbitMQ is a feature rich, multi-protocol messaging and str…6.5
• CVE-2024-5199The Spotify Play Button WordPress plugin through 1.0 does no…5.4
• CVE-2024-51990jj, or Jujutsu, is a Git-compatible VCS written in rust. In …9.3
• CVE-2024-51991October is a Content Management System (CMS) and web platfor…4.9
• CVE-2024-51992Orchid is a @laravel package that allows for rapid applicati…4.1
• CVE-2024-51993Combodo iTop is a web based IT Service Management tool. An a…3.4
• CVE-2024-51994Combodo iTop is a web based IT Service Management tool. In a…5.4