CVE-2023-29424

Summary

CVE-2023-29424 is a stored Cross-Site Scripting (XSS) vulnerability affecting the ShiftController Employee Shift Scheduling plugin, specifically versions 4.9.23 and below, of the Plainware auth solution. An attacker can exploit this flaw by injecting malicious scripts into the plugin's input fields, which are then stored and executed whenever the affected page is loaded. Successful attacks may lead to unauthorized access or data theft, making it essential for users to upgrade to a patched version as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.