CVE-2022-1682

Reflected Xss using url based payload in neorazorx/facturascripts

State: Published
Severity: 9.4 Critical
Published: May 12, 2022
Updated: Aug 3, 2024
Reserved: May 12, 2022

Description

Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser

Scores

CVSS	Score	Vector	Source
3.0	9.4 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	@huntrdev

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
neorazorx/facturascriptsneorazorx	before 2022.07Affected

References

https://huntr.dev/bounties/e962d191-93e2-405e-a6af-b4a4e4d02527
https://github.com/neorazorx/facturascripts/commit/8e31d8434014a6d1e8791a489d84268fd74b0c9a

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.