CVE-2024-28722 is a Cross Site Scripting (CWE-79) vulnerability affecting Innovaphone myPBX versions 14r1, 13r3, and 12r2. The issue arises from improper sanitization of the query parameter in requests to the /CMD0/xml_modes.xml endpoint, enabling remote attackers to inject and execute arbitrary code in the context of the affected application. The vulnerability requires no privileges and user interaction is required (UI:R). The attack vector is network-based (AV:N) with low attack complexity (AC:L).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the affected application, potentially leading to information disclosure, integrity loss, or availability impact. The CVSS score reflects limited confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's security advisories for updates. Until a fix is available, avoid exposing the vulnerable endpoint to untrusted networks or restrict access where possible.