CVE-2022-34879: medium-severity vulnerability in VICIdial
VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_archived_data parameters. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
VICIdial · VICIdialRelated CVEs — VICIdial
In the same product, most dangerous first.
CVE-2024-8503CRITICALVICIdial Unauthenticated SQL InjectionEPSS 79.3%CVE-2024-8504HIGHVICIdial Authenticated Remote Code ExecutionEPSS 76.2%CVE-2022-34876MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.EPSS 3.4%CVE-2022-34877MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.EPSS 3.4%CVE-2022-34878MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.EPSS 3.4%