CVE-2024-30926

DerbyNet, v9.0 and below, is affected by a cross-site scripting (XSS) vulnerability in the ./inc/kiosks.inc component. The root cause is improper sanitization of user-supplied input in URL parameters (notably id and address), allowing remote attackers to inject script and potentially execute arbi...