CVE-2024-25814
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
MyNET up to v26.05 contains a reflected cross-site scripting (XSS) vulnerability via the msg parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
Risk Assessment
Reflected XSS vulnerability may allow session cookie theft, user account takeover, or unauthorized actions, potentially compromising system security.
Recommendation
Update to a version later than v26.05 or implement input validation and encoding mechanisms for the msg parameter.
Other vulnerabilities in MyNET
See all- CVE-2024-27708Critical
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
- CVE-2024-39037Medium
MyNET up to v26.08.316 contains an Unauthenticated SQL Injection vulnerability via the intmenu parameter. An attacker can exploit this flaw without logging into the system.
- CVE-2024-35322Medium
MyNET up to v26.08 contains a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
- CVE-2024-35321Medium
MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
Original NVD description (English source)
MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS