CVE-2024-54128

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.

• CWE-80

• https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2fExploit, Vendor Advisory

Published

Dec 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-54122Concurrent variable access vulnerability in the ability modu…4.7
• CVE-2024-54123Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows X…6.1
• CVE-2024-54124In Click Studios Passwordstate before build 9920, there is a…8.8
• CVE-2024-54125Improper authorization in handler for custom URL scheme issu…3.3
• CVE-2024-54126This vulnerability exists in the TP-Link Archer C50 due to i…8.5
• CVE-2024-54127This vulnerability exists in the TP-Link Archer C50 due to p…4.3
• CVE-2024-54129The NASA’s Interplanetary Overlay Network (ION) is an implem…9.2
• CVE-2024-5413A vulnerability have been discovered in PhpMyBackupPro affec…6.1
• CVE-2024-54130The NASA’s Interplanetary Overlay Network (ION) is an implem…9.2
• CVE-2024-54131The Kolide Agent (aka: Launcher) is the lightweight agent de…7.3
• CVE-2024-54132The GitHub CLI is GitHub’s official command line tool. A sec…6.3
• CVE-2024-54133Action Pack is a framework for handling and responding to we…2.3