Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-29005

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
6.1MEDIUM
EPSS
20.9%
top 4.38%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Phpgurukul Online Birth Certificate System
Timeline
PublishedMay 23
Latest updateMay 24

Description

Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-2v6j-q8j6-q6m9: Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile↗2022-05-24
▶
CVEList
CVE-2022-29005: Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile↗2022-05-23
▶

💥Exploits & PoCs

1
Nuclei
Online Birth Certificate System 1.2 - Stored Cross-Site Scripting
▶
CVE-2022-29005 (MEDIUM CVSS 6.1) | Multiple cross-site scripting (XSS) | cvebase.io