CVE-2022-1045

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
polonelpolonel/trudesk>= unspecified, < v1.2.0

References

Timeline

Published
Apr 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-10464.8The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privCVE-2022-10476.1The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in CVE-2022-10487.0A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_fCVE-2022-10498.8A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwordCVE-2022-10508.8A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commaCVE-2022-10515.4The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the cCVE-2022-10525.5Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.CVE-2022-10539.1Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and tCVE-2022-10545.3The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and haCVE-2022-10557.8A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit reCVE-2022-10565.5Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that CVE-2022-10579.8The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a S
CVE-2022-1045: Medium severity, CVSS 5.4 | Vulnix