CVE-2024-33905

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

CVE-2024-33905

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

CVE-2024-33905

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

CVE-2024-33905: Improper Neutralization of Input During Web Page Generation

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

CVE-2024-33905

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

CVE-2024-33905

Telegram WebK versions prior to 2.0.0 (488) are vulnerable to a Cross-Site Scripting (XSS) flaw within the Mini Web App system. The root cause is improper handling of the postMessage web_app_open_link event type, which allows a crafted Mini Web App to execute malicious scripts. This vulnerability...

PT-2024-25540 · Telegram · Telegram Web K

Name of the Vulnerable Software and Affected Versions: Telegram WebK versions prior to 2.0.0 488 Description: A Cross-Site Scripting XSS flaw in Telegram WebK allows attackers to gain full account access, potentially jeopardizing data and cryptowallets. The issue stems from the Mini App system an...