MyNET Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in MyNET versions through 26.08. This issue allows unauthenticated users to inject HTML and scripts into the 'ficheiro' parameter, as this parameter is not properly sanitized. The vulnerability can be exploited by sending a crafted link to the victim that includes the malicious payload in the 'ficheiro' parameter.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a link to the victim that includes the 'ficheiro' parameter with an unsanitized payload, such as an image tag with an 'onerror' event.