CVE-2024-40111

MEDIUM

Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting in Template Body

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-40111. PoCs published by theexploiters.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for a stored XSS vulnerability in Automad 2.0.0-alpha.4, demonstrating how an attacker can inject malicious JavaScript into the template body, which executes when users visit the affected page.

Description

A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum.

Exploits (1)

nomisec WORKING POC 2 stars
by theexploiters · poc
https://github.com/theexploiters/CVE-2024-40111-Exploit

This repository contains a functional proof-of-concept for a stored XSS vulnerability in Automad 2.0.0-alpha.4, demonstrating how an attacker can inject malicious JavaScript into the template body, which executes when users visit the affected page.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Automad 2.0.0-alpha.4
Auth required
Prerequisites: Admin access to the Automad dashboard
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 4.8
EPSS 0.0461
EPSS Percentile 89.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
automad/automad 2.0.0 alpha4
automad/automad 0Packagist
Published Aug 23, 2024
Tracked Since Feb 18, 2026