‹ Back to list

CVE-2024-3687

Status: DeferredLow (3.5)—
Severity3.5Low · CVSS 3.1
Exploitation probability0.47 %higher than 39% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

A vulnerability was found in bihell Dice 3.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260474 is the identifier assigned to this vulnerability.

CVSS

Base score
3.5
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.47 %
Percentile among all scored CVEs
39
Score date
10/23/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Bihell — DiceAI

CWEs

References

Show 8 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2024-3687",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-3687",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-02T18:29:26.570224Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "vendor": "bihell",
          "modules": [
            "Comment Handler"
          ],
          "product": "Dice",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:bihell:dice:3.1.0:*:*:*:*:*:*:*"
          ],
          "vendor": "bihell",
          "product": "dice",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-12T14:15:08.250",
  "references": [
    {
      "url": "https://github.com/fubxx/CVE/blob/main/DiceCMS-XSS.md",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?ctiid.260474",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?id.260474",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?submit.309445",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/fubxx/CVE/blob/main/DiceCMS-XSS.md",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?ctiid.260474",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?id.260474",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?submit.309445",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in bihell Dice 3.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260474 is the identifier assigned to this vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad fue encontrada en bihell Dice 3.1.0 y clasificada como problemática. Una función desconocida del componente Comment Handler es afectada por esta vulnerabilidad. La manipulación conduce a cross-site scripting. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. VDB-260474 es el identificador asignado a esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T07:44:48.773",
  "sourceIdentifier": "cna@vuldb.com"
}