CVE-2022-40487 - ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function

Back Back to CVE browser

MEDIUM

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function

Published Oct 31, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 0.42%

Description

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

http://processwire.com
https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86
PatchThird Party Advisory
https://github.com/advisories/GHSA-8g35-prrr-gxxf
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40487

Link	Providers	Tags
http://processwire.com
https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86		PatchThird Party Advisory
https://github.com/advisories/GHSA-8g35-prrr-gxxf		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40487