CVEvulnerability
CVE-2022-28051
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-06-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code.
Affected configurations
• seeddms seeddms 5.1.25
• seeddms seeddms 6.0.18
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/blob/main/CVE-2022-28051/README.md Third Party Advisory
- https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28051 Exploit, Third Party Advisory
- https://sourceforge.net/p/seeddms/code/ci/6fc17be5d95e8f00fbe5c124c4acd377fa2ce69d/ Patch, Third Party Advisory
- https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/blob/main/CVE-2022-28051/README.md Third Party Advisory
- https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28051 Exploit, Third Party Advisory
- https://sourceforge.net/p/seeddms/code/ci/6fc17be5d95e8f00fbe5c124c4acd377fa2ce69d/ Patch, Third Party Advisory