CVE-2024-28142

🗓️ 12 Dec 2024 12:35:15Reported by SEC-VLabType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 48 Views🌐 WEB

Missing input sanitization allows cross-site scripting via wildcard characters in "File Name" page.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2024-28142	12 Dec 202412:48	–	circl
CNNVD	Image Access Scan2Net 安全漏洞	12 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-28142 Stored cross site scripting	12 Dec 202412:35	–	cvelist
NVD	CVE-2024-28142	12 Dec 202413:15	–	nvd
Positive Technologies	PT-2024-22292 · Image Access Gmbh · Scan2Net	12 Dec 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-28142	23 May 202507:46	–	redhatcve
Vulnrichment	CVE-2024-28142 Stored cross site scripting	12 Dec 202412:35	–	vulnrichment

[
  {
    "defaultStatus": "affected",
    "product": "Scan2Net",
    "vendor": "Image Access GmbH",
    "versions": [
      {
        "changes": [
          {
            "at": "7.40",
            "status": "unaffected"
          }
        ],
        "lessThan": "7.40",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
r	www.r.sec-consult.com/imageaccess
imageaccess	www.imageaccess.de/
seclists	www.seclists.org/fulldisclosure/2024/Dec/2

Parameter	Position	Path	Description	CWE
-cfilename	query param	/cgi/uset.cgi?-cfilename	XSS via unsanitized file name input in User Settings; arbitrary JavaScript stored and executed on page view.	CWE-79

15 Apr 2026 00:35Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.14.7

EPSS0.00222

SSVC

CWE-79