CVE-2022-4341

csliuwy coder-chain_gdut cross site scripting

A vulnerability has been found in csliuwy coder-chain_gdut and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /back/index.php/user/User/?1. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215095.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Coder-chain Gdut Project

Products

Coder-chain Gdut

CVE-2020-36609

annyshow DuxCMS Article edit cross site scripting

A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215115.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Duxcms Project

Products

Duxcms

CVE-2025-29868

Apache Answer: Using externally referenced images can leak user privacy.

Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Answer

CVE-2020-36610

annyshow DuxCMS cross-site request forgery

A vulnerability was found in annyshow DuxCMS 2.1. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215116.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Duxcms Project

Products

Duxcms

CVE-2022-4347

xiandafu beetl-bbs WebUtils.java cross site scripting

A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file WebUtils.java. The manipulation of the argument user leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215107.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Beetl-bbs Project

Products

Beetl-bbs

CVE-2022-4348

y_project RuoYi-Cloud JSON cross site scripting

A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSON Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215108.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Ruoyi

Products

Ruoyi-cloud

CVE-2022-4349

CTF-hacker pwn delete.html cross-site request forgery

A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215109 was assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pwn Project

Products

Pwn

CVE-2022-4350

Mingsoft MCMS search.do cross site scripting

A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation of the argument content_title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215112.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Mingsoft

Products

Mcms

CVE-2022-4354

LinZhaoguan pb-cms Message Board comment cross site scripting

A vulnerability was found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /blog/comment of the component Message Board. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-215114 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pb-cms Project

Products

Pb-cms

CVE-2022-4375

Mingsoft MCMS list sql injection

A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.

CVSS 3.1 · 6.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Mingsoft

Products

Mcms

CVE-2022-4377

S-CMS Contact Information Page cross site scripting

A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215197 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

S-cms

Products

S-cms

CVE-2022-4396

RDFlib pyrdfa3 __init__.py _get_option cross site scripting

A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function _get_option of the file pyRdfa/__init__.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e. It is recommended to apply a patch to fix this issue. The identifier VDB-215249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Pyrdfa3 Project

Products

Pyrdfa3

CVE-2022-4397

morontt zend-blog-number-2 Comment Comment.php cross-site request forgery

A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/Comment.php of the component Comment Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is 36b2d4abe20a6245e4f8df7a4b14e130b24d429d. It is recommended to apply a patch to fix this issue. VDB-215250 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zend-blog-2 Project

Products

Zend-blog-2

CVE-2022-4399

TicklishHoneyBee nodau db.c sql injection

A vulnerability was found in TicklishHoneyBee nodau. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/db.c. The manipulation of the argument value/name leads to sql injection. The name of the patch is 7a7d737a3929f335b9717ddbd31db91151b69ad2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215252.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nodau Project

Products

Nodau

CVE-2022-4400

zbl1996 FS-Blog Title cross site scripting

A vulnerability was found in zbl1996 FS-Blog and classified as problematic. This issue affects some unknown processing of the component Title Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-215267.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Fs-blog Project

Products

Fs-blog

CVE-2022-4402

RainyGao DocSys ZIP File Decompression path traversal

A vulnerability classified as critical has been found in RainyGao DocSys 2.02.37. This affects an unknown part of the component ZIP File Decompression Handler. The manipulation leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215271.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Docsys Project

Products

Docsys

CVE-2022-4403

SourceCodester Canteen Management System ajax_represent.php sql injection

A vulnerability classified as critical was found in SourceCodester Canteen Management System. This vulnerability affects unknown code of the file ajax_represent.php. The manipulation of the argument customer_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215272.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canteen Management System Project

Products

Canteen Management System

CVE-2021-4244

yikes-inc-easy-mailchimp-extender Plugin add_field_to_form.php cross site scripting

A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 is able to address this issue. The name of the patch is 3662c6593aa1bb4286781214891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Yikesplugins

Products

Easy Forms For Mailchimp

CVE-2022-4416

RainyGao DocSys getReposAllUsers.do getReposAllUsers sql injection

A vulnerability was found in RainyGao DocSys. It has been declared as critical. This vulnerability affects the function getReposAllUsers of the file /DocSystem/Repos/getReposAllUsers.do. The manipulation of the argument searchWord/reposId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-215278 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mxsdoc Project

Products

Mxsdoc

CVE-2022-4421

rAthena FluxCP Service Desk Image URL view.php cross site scripting

A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 8a39b2b2bf28353b3503ff1421862393db15aa7e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215304.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Rathena

Products

Fluxcp