CVE-2024-4336 is a High (CVSS 7.6) persistent cross site scripting flaw in Adive Framework 2.0.8, in the /adive/admin/tables/add page. Several parameters are not encoded, so an attacker can run script in an administrator's browser and read session details. No fix is on record.
What's affected
- Product: Adive Framework 2.0.8, a PHP framework.
- Affected page: /adive/admin/tables/add, through multiple parameters.
- Fixed version: none in the record. The INCIBE CERT notice is the source and it was blocked when I tried it.
- Severity: High, CVSS 7.6. The vector needs user interaction, and the impact is high on confidentiality with low integrity and availability impact.
- Exploitation: KEV is false.
- Sibling record: CVE-2024-4337 is the same class of flaw on the /adive/admin/nav/add page.
How to check if you're exposed
Find sites built on Adive Framework and confirm the version. Version 2.0.8 matches the record.
Then inspect the data in the admin tables list for entries that contain script tags or event handler text. Stored XSS leaves its payload in the database, so a look at the stored values often shows it. Also check who has access to the add page, since the attacker needs a way to submit data.
What to do now
- Inventory sites on Adive Framework 2.0.8.
- Limit the admin area by network or VPN.
- Review stored table entries for script content and clean them.
- Add a Content Security Policy that blocks inline script, and set the HttpOnly and Secure flags on session cookies.
- Read the INCIBE notice and contact the project about a patched release.
Why it matters
The record maps this to CWE-79, cross site scripting. The framework writes input back into a page without encoding it, so text that looks like script is run as script when an administrator views the page.
Stored XSS in an admin area is serious because the victim is a privileged user. A stolen session gives the attacker the same rights. Output encoding, plus cookie flags that hide the session from script, limit the damage.
Quick check
What does stored XSS mean?
The malicious input is saved on the server and served to later visitors, so it fires every time the page loads, not only once.
How is CVE-2024-4336 different from CVE-2024-4337?
They are the same weakness on two admin pages: tables/add and nav/add.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4336 (published 2024-04-30) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
