CVE-2024-41572: lang-learn-guy learning with texts

csirt@kutim:~/threat-intel/cve/CVE-2024-41572

CVSS 6.1 · Medium EPSS 0,30%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada lang-learn-guy learning with texts. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user credentials or execute actions such as injecting malicious scripts or redirecting users to malicious sites.

Rincian

Terbit di NVD: 21 Agustus 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 21,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lang-learn-guy	learning with texts	Versi 2.0.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://medium.com/%40ChadSecurity/cve-2024-41572-68397fae354b advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.