onyx

onyx --cves cve-2024-23724

CVE-2024-23724

CRITPOCGhost
score
<0.1
cvss
9.0
epss
3.5%
published
2024-02-11
kev added
—
first seen

Ghost 5.76.0 contains a stored XSS caused by SVG profile pictures containing JavaScript code, letting attackers escalate privileges and take over accounts, exploit requires uploading malicious SVG images.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2024-02-11 — PublishedP2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoC: https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2024-23724Xscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 3.5%2026-09-23: epss 3.5%2026-09-24: epss 3.5%2026-09-25: epss 3.5%2026-09-26: epss 3.5%2026-09-27: epss 3.5%2026-09-28: epss 3.5%2026-09-29: epss 3.5%2026-09-30: epss 3.5%2026-10-01: epss 3.5%2026-10-02: epss 3.5%2026-10-03: epss 3.5%2026-10-04: epss 3.5%2026-10-05: epss 3.5%2026-10-06: epss 3.5%2026-10-07: epss 3.5%2026-10-08: epss 3.5%2026-10-09: epss 3.5%2026-10-10: epss 3.5%2026-10-11: epss 3.5%2026-10-12: epss 3.5%2026-10-13: epss 3.5%2026-10-14: epss 3.5%2026-10-15: epss 3.5%2026-10-16: epss 3.5%2026-10-18: epss 3.5%2026-10-19: epss 3.5%2026-10-20: epss 3.5%2026-10-21: epss 3.5%3.5%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2024-23724

Exploit availability

Weaknesses

CWE-79

References 3