CVE-2022-1290

Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk

State: Published
Severity: 9.0 Critical
Published: Apr 10, 2022
Updated: Aug 2, 2024
Reserved: Apr 10, 2022

Description

Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

Scores

CVSS	Score	Vector	Source
3.0	9.0 Critical	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	@huntrdev

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
polonel/trudeskpolonel	before v1.2.0Affected

References

https://huntr.dev/bounties/da6d03e6-053f-43b6-99a7-78c2e386e3ed
https://github.com/polonel/trudesk/commit/4f48b3bb86ba66a0085803591065bb6437e864ec

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.