CVE-2022-44957

MEDIUMNuclei

WebTareas 2.4p5 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-44957 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 24, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMWebTareas 2.4p5 - Cross-Site ScriptingCVSS 5.4

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

Impact

Authenticated attackers can inject malicious JavaScript through the client Name field, potentially stealing session tokens and performing unauthorized actions on behalf of other WebTareas users.

Remediation

Update webtareas to a version newer than 2.4p5 that properly sanitizes the Name field input and encodes output in listclients.php.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2022xsswebtareasauthenticatedintrusivewebtareas_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:webtareas_project:webtareas:2.4:p5:*:*:*:*:*:*
http://webtareas.com/ https://github.com/anhdq201/webtareas/issues/11 https://nvd.nist.gov/vuln/detail/CVE-2022-44957 http://webtareas.com/

Source: ProjectDiscovery

References

3