CVE-2024-36494: Image Access GmbH SCAN2NET

Medium severity, CVSS 4.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.

Affected products

Published 2024-12-12. Last modified 2026-06-17.