CVE-2023-39846

CVE-2023-39846 affects Konga v0.14.9 and enables authentication bypass via a crafted JWT token. The CVSSv3.1 base score is 9.8 (CRITICAL) with Network attack vector, low complexity, and no privileges/user interaction required. Documented impact is total compromise of confidentiality, integrity, a...

CVE-2024-34243

CVE-2024-34243 affects Konga v0.14.9 with Cross-Site Scripting (XSS) via the username parameter. The linked sources indicate the underlying issue is inadequate input validation on the username field, enabling injected scripts. The CVE is recorded with a CVSS v3.1 base score of 5.4 (Medium) and sh...