Stored Cross-Site Scripting Vulnerability in Serge Software by Sergetech

CVE-2024-11441

What is CVE-2024-11441?

A stored cross-site scripting (XSS) vulnerability exists in Serge version 0.9.0 due to improper data handling during the generation of web pages in the chat prompt feature. This flaw allows an attacker to craft a malicious message containing HTML or JavaScript code, which is then stored on the server. Whenever users access the chat, the malicious content is executed, potentially leading to the display of unauthorized information and increasing the risk of phishing attacks. Addressing this vulnerability is critical for maintaining the integrity and security of user interactions.

References