Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint
References
Configurations
No configuration.
History
21 Nov 2024, 09:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://innovaphone.com - | |
| References | () http://mypbx.com - | |
| References | () https://wiki.innovaphone.com/index.php?title=Reference14r1:Release_Notes_Firmware#159317_-_Advanced_UI:_Prevent_XSL_injection - |
03 Jul 2024, 01:51
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.3 |
22 Apr 2024, 13:28
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
22 Apr 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-22 01:15
Updated : 2024-11-21 09:06
NVD link : CVE-2024-28722
Mitre link : CVE-2024-28722
CVE.ORG link : CVE-2024-28722
JSON object : View
Products Affected
No product.
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')