CVE-2022-31470
50Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 52%
from disclosure to weapon458 days
Published on NVDJun 7
1st PoC+458d
exploitation probability
52%top 1% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.
Affected products
n/a · n/apublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/51722unverifiedcve_referencepacketstormsecurity.com/files/174551/Axigen-10.5.0-4370c946-Cross-Site-Scripting.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.