CVE-2022-1086

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in DolphinPHP up to 1.5.0 and classified as problematic. Affected by this issue is the User Management Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
unspecified	DolphinPHP	1.0; 1.1; 1.2; 1.3; 1.4; 1.5

References

https://github.com/xiahao90/CVEproject/blob/main/DolphinPHPV1.5.0_xss.mdExploit, Third Party Advisory
https://vuldb.com/?id.195368Third Party Advisory
https://github.com/xiahao90/CVEproject/blob/main/DolphinPHPV1.5.0_xss.mdExploit, Third Party Advisory
https://vuldb.com/?id.195368Third Party Advisory

Timeline

Published: Mar 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10875.4A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipu CVE-2022-10884.8The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high pri CVE-2022-10894.8The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high p CVE-2022-10904.8The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users suc CVE-2022-10916.1The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upl CVE-2022-10924.3The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowi CVE-2022-10934.8The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowin CVE-2022-10944.8The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2022-10954.8The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privil CVE-2022-10968.8Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted H CVE-2022-10976.5<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading CVE-2022-10987.8Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrec