CVE-2022-30073

MEDIUMNuclei

WBCE CMS 1.5.2 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-30073 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWBCE CMS 1.5.2 - Cross-Site ScriptingCVSS 5.4

WBCE CMS 1.5.2 contains a stored cross-site scripting vulnerability via \admin\user\save.php Display Name parameters.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to a patched version of WBCE CMS or apply the vendor-supplied patch to mitigate this vulnerability.

WeaknessesCWE-79
Authorsarafatansari
Template tagscve2022cvewbcecmsxsswbcevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wbce:wbce_cms:1.5.2:*:*:*:*:*:*:*
https://github.com/APTX-4879/CVE https://github.com/APTX-4879/CVE/blob/main/CVE-2022-30073.pdf https://nvd.nist.gov/vuln/detail/CVE-2022-30073 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3