CVE-2022-2646
published 2022-08-04CVE-2022-2646: A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Affected is an unknown function of the file…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.58%
43.7th percentile
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Affected is an unknown function of the file index.php. The manipulation of the argument eid with the input 8alert(1) leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205572.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sourcecodester | online_admission_system | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rhq4-fxqr-q589: A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System
ghsa_unreviewed·2022-08-05
CVE-2022-2646 [MEDIUM] CWE-79 GHSA-rhq4-fxqr-q589: A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Affected is an unknown function of the file index.php. The manipulation of the argument eid with the input 8alert(1) leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205572.
GHSA
Stored Cross-site Scripting in folder-auth plugin
ghsa·2022-03-18
CVE-2022-27200 [MEDIUM] CWE-79 Stored Cross-site Scripting in folder-auth plugin
Stored Cross-site Scripting in folder-auth plugin
Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.
See https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2646
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-04
Published