CVE-2023-51946

36th percentile - higher than 36% of all known CVEs

Multiple reflected XSS vulnerabilities were found in nasSvr.php of actiNAS-SL-2U-8 version 3.2.03-SP1. They allow remote attackers to inject arbitrary web script or HTML.

An attacker can exploit these vulnerabilities to steal user sessions, redirect to malicious sites, or perform other actions in the victim's browser context, compromising data confidentiality and integrity.

Update actiNAS software to the latest patched version immediately. Until then, restrict access to the admin panel and apply anti-XSS filters.