CVE-2024-39037
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
MyNET up to v26.08.316 contains an Unauthenticated SQL Injection vulnerability via the intmenu parameter. An attacker can exploit this flaw without logging into the system.
Risk Assessment
The vulnerability could allow unauthorized access to and modification of the database, posing a serious threat to system security.
Recommendation
Update MyNET to a version that fixes this vulnerability or apply appropriate mitigations as soon as possible. Also, implement input validation and parameterized queries.
Other vulnerabilities in MyNET
See all- CVE-2024-27708Critical
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
- CVE-2024-35322Medium
MyNET up to v26.08 contains a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
- CVE-2024-35321Medium
MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
- CVE-2024-25814Medium
MyNET up to v26.05 contains a reflected cross-site scripting (XSS) vulnerability via the msg parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.
Original NVD description (English source)
MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via the intmenu parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS