CVE-2024-28734: UNIT4 Financials

Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days.

Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter.

Affected products

• UNIT4 Financials: before 2023Q4 (fixed in 2023Q4)

Published 2024-03-19. Last modified 2026-06-17.