CVE-2024-56882

Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with the modified data elements.

• CWE-79

• https://cves.at/posts/cve-cve-2024-56882/writeup/Exploit, Third Party Advisory

Published

Feb 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56840A vulnerability has been identified in RUGGEDCOM ROX MX5000 …7.5
• CVE-2024-56841A vulnerability has been identified in Mendix LDAP (All vers…9.1
• CVE-2024-5685Users with "User:edit" and "Self:api" permissions can promot…8.1
• CVE-2024-5686The WPZOOM Addons for Elementor (Templates, Widgets) plugin …5.4
• CVE-2024-5687If a specific sequence of actions is performed when opening …5.3
• CVE-2024-5688If a garbage collection was triggered at the right time, a u…8.1
• CVE-2024-56883Sage DPW before 2024_12_001 is vulnerable to Incorrect Acces…8.1
• CVE-2024-56889Incorrect access control in the endpoint /admin/m_delete.php…7.5
• CVE-2024-5689In addition to detecting when a user was taking a screenshot…4.3
• CVE-2024-56897Improper access control in the HTTP server in YI Car Dashcam…9.8
• CVE-2024-56898Broken access control vulnerability in Geovision GV-ASWeb wi…8.8
• CVE-2024-5690By monitoring the time certain operations take, an attacker …4.3