PT-2024-25763 · Konga · Konga

Published 2024-05-14 · Updated 2025-06-13 · CVE-2024-34243

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Konga version 0.14.9

Description The issue allows for Cross Site Scripting (XSS) via the username parameter.

Recommendations For Konga version 0.14.9, avoid using the username parameter until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34243

GHSA-93PF-MRC8-4G3H

Affected Products

Konga

References · 6

• 🔥 https://github.com/JByteL/CVE/tree/main/CVE-2024-34243 · Exploit
• https://osv.dev/vulnerability/GHSA-93pf-mrc8-4g3h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34243 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34243 · Vendor Advisory
• https://github.com/pantsel/konga · Note
• https://t.me/cvenotify/125619 · Telegram Post