CVE-2022-40487

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.
References
Link Resource
http://processwire.com Product Vendor Advisory
https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86 Patch Third Party Advisory
http://processwire.com Product Vendor Advisory
https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:processwire:processwire:3.0.200:*:*:*:*:*:*:*

History

21 Nov 2024, 07:21

Type Values Removed Values Added
References () http://processwire.com - Product, Vendor Advisory () http://processwire.com - Product, Vendor Advisory
References () https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86 - Patch, Third Party Advisory () https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86 - Patch, Third Party Advisory

01 Nov 2022, 17:32

Type Values Removed Values Added
CPE cpe:2.3:a:processwire:processwire:3.0.200:*:*:*:*:*:*:*
CWE CWE-79
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.1
CPE cpe:2.3:a:processwire:processwire:3.0.200:*:*:*:*:*:*:*
References (MISC) http://processwire.com - (MISC) http://processwire.com - Product, Vendor Advisory
References (MISC) https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86 - (MISC) https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86 - Patch, Third Party Advisory

31 Oct 2022, 12:57

Type Values Removed Values Added
New CVE

Information

Published : 2022-10-31 12:15

Updated : 2024-11-21 07:21


NVD link : CVE-2022-40487

Mitre link : CVE-2022-40487

CVE.ORG link : CVE-2022-40487


JSON object : View

Products Affected

processwire

  • processwire
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')