Medium severity5.4NVD Advisory· Published Aug 15, 2024· Updated Jun 17, 2026
CVE-2024-6533
CVE-2024-6533
Description
Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
4- fluidattacks.com/advisories/bocellinvdExploitThird Party Advisory
- github.com/advisories/GHSA-9qrm-48qf-r2rwghsaADVISORY
- directus.ionvdProduct
- github.com/directus/directus/security/advisories/GHSA-9qrm-48qf-r2rwghsa
News mentions
0No linked articles in our index yet.