Mathias Tausig

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.

**Name of the Vulnerable Software and Affected Versions** IRIS web application version 2.4.26 **Description** The logout functionality is ineffective, allowing stolen session cookies to be misused for an extended period. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.