SMSEagle Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in SMSEagle software versions prior to 6.11. This issue allows an attacker to inject malicious JavaScript into a username or contact phone number, which is executed when an administrator edits the affected property in the web interface.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Remediation

Users are advised to update their SMSEagle software to version 6.11 or higher. The update can be performed via the web interface under Settings > Updates. For offline update packages, contact the SMSEagle Support Center.