CVE-2024-35321
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
Risk Assessment
An attacker may trick a user into clicking a crafted link, executing malicious script in their browser and potentially stealing their session.
Recommendation
Update MyNET to a patched version and implement input validation and encoding for parameters reflected in responses.
Other vulnerabilities in MyNET
See all- CVE-2024-27708Critical
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
- CVE-2024-39037Medium
MyNET up to v26.08.316 contains an Unauthenticated SQL Injection vulnerability via the intmenu parameter. An attacker can exploit this flaw without logging into the system.
- CVE-2024-35322Medium
MyNET up to v26.08 contains a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
- CVE-2024-25814Medium
MyNET up to v26.05 contains a reflected cross-site scripting (XSS) vulnerability via the msg parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
Original NVD description (English source)
MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS