CVE-2022-26565

Опубликовано: 01 апр. 2022

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Name text field when creating a new page.

Ссылки

https://bug.pocas.kr/2022/03/01/2022-03-05-CVE-2022-26565/
Exploit
Third Party Advisory
https://github.com/totaljs/cms/issues/35
Exploit
Issue Tracking
Patch
Third Party Advisory
https://bug.pocas.kr/2022/03/01/2022-03-05-CVE-2022-26565/
Exploit
Third Party Advisory
https://github.com/totaljs/cms/issues/35
Exploit
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:totaljs:content_management_system:*:*:*:*:*:node.js:*:*

Версия до 2022-02-28 (исключая)

EPSS

Процентиль: 53%

0.00299

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-g837-7gx4-95rv