Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-2599

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
6.1MEDIUM
EPSS
30.9%
top 3.26%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Unknown Anti-malware Security AND Brute-force FirewallAnti-malware Security AND Brute-force Firewall Project Anti-malware Security AND Brute-force Firewall
Timeline
PublishedAug 29

Description

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
Anti-Malware Security and Brute-Force Firewall < 4.21.83 - Reflected Cross-Site Scripting↗2022-08-29
▶
GHSA
GHSA-6c8f-q735-wjp5: The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4↗2022-08-29
▶

💥Exploits & PoCs

1
Nuclei
WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting
▶
CVE-2022-2599 (MEDIUM CVSS 6.1) | The Anti-Malware Security and Brute | cvebase.io