CVE-2022-28363

MEDIUMNuclei

reprisesoftware reprise_license_manager Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2022-28363 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No authentication is required.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 5, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

reprise_license_manager

Browse reprisesoftware / reprise_license_manager
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMReprise License Manager 14.2 - Cross-Site ScriptingCVSS 6.1

Reprise License Manager 14.2 contains a reflected cross-site scripting vulnerability in the /goform/login_process 'username' parameter via GET, whereby no authentication is required.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a patched version of Reprise License Manager or apply the vendor-supplied patch to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsAkincibor
Template tagscvecve2022xssrlmpacketstormreprisesoftwarevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:reprisesoftware:reprise_license_manager:14.2:*:*:*:*:*:*:*
Shodan: http.html:"reprise license"
Shodan: http.html:"reprise license manager"
FOFA: body="reprise license manager"
FOFA: body="reprise license"
Google: inurl:"/goforms/menu"
https://www.reprisesoftware.com/products/software-license-management.php https://github.com/advisories/GHSA-rpvc-qgrm-r54f http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html https://nvd.nist.gov/vuln/detail/CVE-2022-28363 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

4