CVE-2022-4377

LOW

S-CMS 5.0 Build 20220328 - Cross-Site Scripting via Contact Information Page

Title source: llm

Description

A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215197 was assigned to this vulnerability.

References (2)

Core 2

Core References

Broken Link, Third Party Advisory

https://github.com/mengdeyin/main/blob/main/README.md

Third Party Advisory, VDB Entry

https://vuldb.com/?id.215197

Scores

CVSS v3 3.5

EPSS 0.0037

EPSS Percentile 28.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-707

Status published

Products (1)

s-cms/s-cms 5.0

Published Dec 09, 2022

Tracked Since Feb 18, 2026