CVE-2022-29034

The SINEMA Remote Connect Server web interface has a flaw where error messages don't block JavaScript code, allowing attackers to inject malicious scripts that execute in users' browsers when they click a specially crafted link.

A reflected XSS vulnerability exists in the error message pop-up window of the web interface where user input is not properly sanitized or encoded. An unauthenticated attacker can craft a malicious URL containing JavaScript payload that executes in the victim's browser context when accessed, potentially leading to session hijacking or credential theft.