Threat Intelligence Database

The IRIS web application version 2.4.26 has a vulnerability where it does not protect user authentication against brute-force attacks. This issue relates to the allocation of resources without limits or throttling, potentially allowing attackers to attempt many authentication requests. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation has been confirmed yet.

A stored cross-site scripting (XSS) vulnerability exists in the IRIS web application version 2.4.26, specifically in the datastore upload function. This vulnerability allows an attacker with limited privileges to inject malicious scripts that can execute in the context of other users. The vulnerability is classified as CWE-79 and has a high severity score of 7.6. No official patch or remediation guidance is currently provided by the vendor.

A stored cross-site scripting (XSS) vulnerability exists in the IRIS web application version 2.4.26 within the custom attributes function. This vulnerability allows an attacker with low privileges and user interaction to inject malicious scripts that can compromise confidentiality and partially impact integrity. The vulnerability has a high severity score of 7.6 and affects version 2.4.26 specifically.

CVE-2026-16971 is a medium severity vulnerability in the dfir-iris iris-web application version 2.4.26. The issue involves the lack of protection for multi-factor authentication (MFA) validation against brute-force attacks, related to allocation of resources without limits or throttling (CWE-770). This could allow an attacker to repeatedly attempt MFA validation without restriction. No official patch or remediation guidance is currently available from the vendor.

The IRIS web application version 2.4.26 has an ineffective logout functionality that results in insufficient session expiration. This vulnerability allows stolen session cookies to be reused for an extended period, potentially leading to unauthorized access. The CVSS score is 4.2, indicating a medium severity level.

The IRIS web application version 2.4.26 contains a stored cross-site scripting (XSS) vulnerability in its assets function. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute malicious scripts in the context of the affected application. The vulnerability is classified as CWE-79 and has a high severity rating with a CVSS score of 7.6. No official patch or remediation has been confirmed at this time.