{"id":"CVE-2024-46639","aliases":["EUVD-2024-41921","GHSA-7pp5-7gq3-2q5p"],"status":"published","title":"A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute...","description":"A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00475,"percentile":0.41365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2024-09-23T00:00:00Z","modified":"2026-06-17T07:55:38Z","products":[{"vendor":"evolutionscript","product":"helpdeskz"}],"references":[{"url":"https://github.com/0xashfaq/-HelpDeskZ-v2.0.2---Stored-Cross-Site-Scripting-XSS-"},{"url":"https://gist.github.com/0xashfaq/45c3f300d125468161c3fa6e38576769"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46639"},{"url":"https://github.com/advisories/GHSA-7pp5-7gq3-2q5p"}],"sources":{"cve":[{"id":"CVE-2024-46639","description":"A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.","status":"published","published":"2024-09-23T00:00:00Z","modified":"2024-09-23T19:52:50.458Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:08.500935Z"}],"euvd":[{"id":"EUVD-2024-41921","description":"A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.","status":"published","published":"2024-09-23T00:00:00Z","modified":"2024-09-23T19:52:50Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:28:16.146478Z"}],"ghsa":[{"id":"GHSA-7pp5-7gq3-2q5p","title":"A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute...","description":"A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.","status":"published","published":"2024-09-23T21:30:47Z","modified":"2024-09-23T21:30:58Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:58:19.788112Z"}],"nvd":[{"id":"CVE-2024-46639","description":"A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.","status":"published","published":"2024-09-23T20:15:05.417Z","modified":"2026-06-17T07:55:38.897Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:27.456509Z"}]}}