VULNERABILITY INTELLIGENCE
CVE-2024-41805
CVSS score6.1 MEDIUM
EPSS probability0.40%
CISA KEVNot currently listed
Published2024-07-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting enables execution of malicious JavaScript in the context of a user’s browser if that user clicks on a malicious link, allowing phishing attacks that could lead to credential theft. Tracks version 2.7.1 is patched. No known complete workarounds are available.
Weakness classification
- security-advisories@github.com: CWE-79