CVE-2024-40511

The openPetra management software (version 2023.02 ) is vulnerable to a Cross-Site Scripting (XSS) flaw in the serverMServerAdmin.asmx function. An unauthenticated remote attacker can exploit this to steal cookies from authenticated users by injecting a payload into the tab parameter (e.g., via h...