CVE-2024-34243 - Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter

MEDIUM

Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter

Published May 14, 2024

6.1

MEDIUM

CVSS 3.1

EPSS 0.45%

Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter.

Ecosystem	Package	Introduced	Fixed
npm	kongadmin	0	not fixed

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1536		Advisory
https://github.com/JByteL/CVE/tree/main/CVE-2024-34243		Exploit
https://github.com/advisories/GHSA-93pf-mrc8-4g3h		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-34243

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published May 14, 2024

Updated Mar 28, 2025

Reserved May 2, 2024

Updated May 15, 2024

Status Analyzed

Modified Jun 17, 2026

Severity n/a

Public date n/a

Assigner mitre

Published May 14, 2024

Updated Mar 28, 2025

Exploited since n/a