What’s Vulnerable › Vulnerabilities

CVE-2024-49378: smartUp Cross-site Scripting vulnerability

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-25 · updated 2026-06-17
• Weakness: CWE-79

Description

smartUp, a web browser mouse gestures extension, has a universal cross-site scripting issue in the Edge and Firefox versions of smartUp 7.2.622.1170. The vulnerability allows another extension to execute arbitrary code in the context of the user’s tab. As of time of publication, no known patches exist.

Affected products

• zimocode smartup: through 7.2.622.1170

References

• https://github.com/zimocode/smartup/blob/2144ec161697751b1a6702f1af866726ea689e4e/js/background.js#L3800
• https://securitylab.github.com/advisories/GHSL-2024-011_smartup/

Get alerted when CVE-2024-49378 or the next vulnerability affects your stack