CVE-2022-26644

46th percentile - higher than 46% of all known CVEs

Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.

An attacker can exploit these vulnerabilities to inject malicious JavaScript code, potentially leading to session hijacking, account takeover, or theft of sensitive financial data.

Immediately update the system to the latest version or apply a security patch. Additionally, implement input validation and sanitization, and use Content Security Policy (CSP) headers.