CVE-2022-39020
Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd
- State
- Published
- Severity
- 7.6 High
- Published
- Oct 31, 2022
- Updated
- May 6, 2025
- Reserved
- Aug 30, 2022
Description
Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L | TML |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
SchoolboxSchoolbox Pty Ltd |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.