CVE-2024-34321
6.1MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary JavaScript in the victim's browser session to steal sensitive session data. Exploitation requires an unauthenticated attacker to trick a user into clicking a crafted link.
Root cause
Improper input sanitization allows reflected script injection via the PageTitle/Notes parameter on the Notes.aspx endpoint.
Affected systems
ProPhoenix Law RMS v2022.2403.3.101
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Contact the vendor ProPhoenix for a patched release as no specific fixed version is listed. As an interim workaround, deploy a WAF rule to inspect and block script tags or payload patterns targeting the Notes.aspx endpoint.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.