CVE-2022-1514: critical vulnerability in neorazorx/facturascripts
Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9epss 0.8%
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
neorazorx · neorazorx/facturascriptsRelated CVEs — neorazorx/facturascripts
In the same product, most dangerous first.
CVE-2022-1715CRITICALAccount Takeover in neorazorx/facturascriptsEPSS 1.4%CVE-2022-2066HIGHCross-site Scripting (XSS) - Reflected in neorazorx/facturascriptsEPSS 1.0%CVE-2022-1571CRITICALCross-site scripting - Reflected in Create Subaccount in neorazorx/facturascriptsEPSS 0.9%CVE-2022-1988MEDIUMCross-site Scripting (XSS) - Generic in neorazorx/facturascriptsEPSS 0.8%CVE-2022-1682CRITICALReflected Xss using url based payload in neorazorx/facturascriptsEPSS 0.8%CVE-2022-1457CRITICALStore XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascriptsEPSS 0.8%