CVE-2024-28722

MediumCVSS 6.3

Published: 22/04/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

37th percentile - higher than 37% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in Innovaphone myPBX versions v.14r1, v.13r3, and v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint.

Risk Assessment

An attacker can inject malicious scripts, leading to session theft, account takeover, or further escalation within the organization's internal network.

Recommendation

Immediately update Innovaphone myPBX to the latest available version and apply input filtering for the query parameter.

Original NVD description (English source)

Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint