{"id":"CVE-2024-3776","aliases":["EUVD-2024-32348","GHSA-vvpm-6ch5-2gq3"],"status":"published","title":"Netvision airPASS - Reflected XSS","description":"The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00407,"percentile":0.35366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-04-15T02:58:41Z","modified":"2026-06-17T07:45:00Z","products":[{"vendor":"netvision","product":"airpass"},{"vendor":"netvision information","product":"airpass"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7730-584e3-1.html","tags":["third-party-advisory","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3776"},{"url":"https://github.com/advisories/GHSA-vvpm-6ch5-2gq3"}],"sources":{"cve":[{"id":"CVE-2024-3776","title":"Netvision airPASS - Reflected XSS","description":"The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.","status":"published","published":"2024-04-15T02:58:41.818Z","modified":"2024-08-01T20:20:02.489Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:10.613319Z"}],"euvd":[{"id":"EUVD-2024-32348","description":"The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.","status":"published","published":"2024-04-15T02:58:41Z","modified":"2024-08-01T20:20:02Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:37.919987Z"}],"ghsa":[{"id":"GHSA-vvpm-6ch5-2gq3","title":"The parameter used in the login page of Netvision airPASS is not properly filtered for user input...","description":"The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.","status":"published","published":"2024-04-15T06:30:34Z","modified":"2024-04-15T06:31:23Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:57:12.357893Z"}],"nvd":[{"id":"CVE-2024-3776","description":"The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.","status":"published","published":"2024-04-15T04:15:16.34Z","modified":"2026-06-17T07:45:00.25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:50.299382Z"}]}}