CVE-2022-41392 - A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings

Back Back to CVE browser

MEDIUM

A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings

Published Oct 7, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.85%

Description

A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/totaljs/cms/issues/38
ExploitIssue TrackingThird Party Advisory
https://www.edoardoottavianelli.it/CVE-2022-41392/
ExploitThird Party Advisory
https://www.youtube.com/watch?v=BOPLYnveBqk
ExploitThird Party Advisory

Link	Providers	Tags
https://github.com/totaljs/cms/issues/38		ExploitIssue TrackingThird Party Advisory
https://www.edoardoottavianelli.it/CVE-2022-41392/		ExploitThird Party Advisory
https://www.youtube.com/watch?v=BOPLYnveBqk		ExploitThird Party Advisory