CVE-2022-43185

MEDIUM NUCLEI

Rukovoditel 3.2.1 - Stored Cross-Site Scripting in Configuration/Holidays Name Parameter

Title source: llm

Exploitation Summary

CVE-2022-43185 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.

Nuclei Templates (1)

Rukovoditel <= 3.2.1 - Cross-Site Scripting

MEDIUMVERIFIEDby r3Y3r53

Shodan: http.favicon.hash:-1499940355

FOFA: icon_hash=-1499940355

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory

https://github.com/Kubozz/rukovoditel-3.2.1/issues/1

Scores

CVSS v3 5.4

EPSS 0.0096

EPSS Percentile 56.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

rukovoditel/rukovoditel 3.2.1

Published Oct 19, 2022

Tracked Since Feb 18, 2026