CVE-2024-9969

NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters, resulting in a Reflected Cross-site Scripting (XSS) attack. The affected product is no longer maintained. It is recommended to upgrade to the new product.

• CWE-79

• https://www.twcert.org.tw/en/cp-139-8135-ce1e6-2.htmlThird Party Advisory
• https://www.twcert.org.tw/tw/cp-132-8134-c476d-1.htmlThird Party Advisory

Published

Oct 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9963Insufficient data validation in Downloads in Google Chrome p…4.3
• CVE-2024-9964Inappropriate implementation in Payments in Google Chrome pr…4.3
• CVE-2024-9965Insufficient data validation in DevTools in Google Chrome on…8.8
• CVE-2024-9966Inappropriate implementation in Navigations in Google Chrome…5.3
• CVE-2024-9967The WP show more plugin for WordPress is vulnerable to Store…5.4
• CVE-2024-9968WebEIP v3.0 from NewType does not properly validate user i…8.8
• CVE-2024-9970The FlowMaster BPM Plus system from NewType has a privilege …8.8
• CVE-2024-9971The specific query functionality in the FlowMaster BPM Plus …8.8
• CVE-2024-9972Property Management System from ChanGate has a SQL Injection…9.8
• CVE-2024-9973A vulnerability was found in SourceCodester Online Eyewear S…9.8
• CVE-2024-9974A vulnerability was found in SourceCodester Online Eyewear S…9.8
• CVE-2024-9975A vulnerability was found in SourceCodester Drag and Drop Im…8.8