CVE-2024-6533

Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.

• CWE-79

• https://directus.io/Product
• https://fluidattacks.com/advisories/bocelliExploit, Third Party Advisory

Published

Aug 15, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6527SQL Injection vulnerability in parameter "w" in file "druk.p…9.3
• CVE-2024-6528CWE-79: Improper Neutralization of Input During Web Page Gen…6.1
• CVE-2024-6529The Ultimate Classified Listings WordPress plugin before 1.4…7.1
• CVE-2024-6530A cross-site scripting issue has been discovered in GitLab a…5.4
• CVE-2024-6531Rejected reason: This was not a security issue in Bootstrap.…
• CVE-2024-6532The Sheet to Table Live Sync for Google Sheet plugin for Wor…6.4
• CVE-2024-6534Directus v10.13.0 allows an authenticated external attacker …4.3
• CVE-2024-6535A flaw was found in Skupper. When Skupper is initialized wit…5.3
• CVE-2024-6536The Zephyr Project Manager WordPress plugin before 3.3.99 do…5.4
• CVE-2024-6538A flaw was found in OpenShift Console. A Server Side Request…5.3
• CVE-2024-6539A vulnerability classified as problematic has been found in …4.8
• CVE-2024-6540Improper filtering of fields when using the export function …5.3