CVE-2024-36498

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. Version 7.40 implemented a fix, but it could be bypassed via URL-encoding the Javascript payload again.

• CWE-79

• https://r.sec-consult.com/imageaccess
• https://www.imageaccess.de/?page=SupportPortal&lang=en
• http://seclists.org/fulldisclosure/2024/Dec/2

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36492Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <=…6.4
• CVE-2024-36493A stack-based buffer overflow vulnerability exists in the wi…7.2
• CVE-2024-36494Due to missing input sanitization, an attacker can perform c…4.7
• CVE-2024-36495The application Faronics WINSelect (Standard + Enterprise) s…7.7
• CVE-2024-36496The configuration file is encrypted with a static key derive…7.5
• CVE-2024-36497The decrypted configuration file contains the password in cl…9.1
• CVE-2024-36499Vulnerability of unauthorized screenshot capturing in the WM…5.5
• CVE-2024-3650The ElementsKit Elementor addons plugin for WordPress is vul…5.4
• CVE-2024-36500Privilege escalation vulnerability in the AMS module Impact:…5.5
• CVE-2024-36501Memory management vulnerability in the boottime module Impac…5.5
• CVE-2024-36502Out-of-bounds read vulnerability in the audio module Impact:…5.5
• CVE-2024-36503Memory management vulnerability in the Gralloc module Impact…5.5