CVE-2024-36498 is a stored cross-site scripting (XSS) vulnerability in the "Edit Disclaimer Text" function of a web-based ScanWizard configuration menu. The flaw arises from missing input sanitization, allowing attackers with Poweruser or Admin privileges to inject arbitrary JavaScript. This malicious script executes whenever the ScanWizard loads, including in Kiosk mode. Although version 7.40 introduced a fix, it can be bypassed by double URL-encoding the payload.