CVE-2024-27708
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
Risk Assessment
The risk for the organization is the possibility of executing malicious code in the context of the application, which can lead to data security breaches or session hijacking.
Recommendation
It is recommended to update MyNET to the latest version that fixes this vulnerability and to validate and sanitize the src parameter to prevent iframe injection.
Other vulnerabilities in MyNET
See all- CVE-2024-39037Medium
MyNET up to v26.08.316 contains an Unauthenticated SQL Injection vulnerability via the intmenu parameter. An attacker can exploit this flaw without logging into the system.
- CVE-2024-35322Medium
MyNET up to v26.08 contains a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
- CVE-2024-35321Medium
MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
- CVE-2024-25814Medium
MyNET up to v26.05 contains a reflected cross-site scripting (XSS) vulnerability via the msg parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
Original NVD description (English source)
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS