CVE-2024-34326

—Unscored

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

—Unscored

Attack vector: —
Complexity: —
Privileges needed: —
User interaction: —
Impact: —
Weakness: —

Impact

Attackers can execute arbitrary JavaScript in a victim's browser session to steal credentials or perform unauthorized actions. This requires tricking an authenticated user into clicking a crafted URL targeting the application.

Root cause

The errorHandler.aspx endpoint reflects input from the PageTitle, Alert, and MsgType parameters directly into the response without adequate sanitization or output encoding.

Affected systems

ProPhoenix Law RMS v2022.2403.3.101.

Fix & remediation

Contact ProPhoenix for an updated build or patch that sanitizes input to errorHandler.aspx. As an interim workaround, use a web application firewall or reverse proxy rule to block or sanitize requests containing HTML tags or scripts in the PageTitle, Alert, and MsgType query parameters.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.

References

Source: nvd.nist.gov/vuln/detail/CVE-2024-34326