CVE-2022-1290

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
polonel	polonel/trudesk	>= unspecified, < v1.2.0

References

https://github.com/polonel/trudesk/commit/4f48b3bb86ba66a0085803591065bb6437e864ecPatch, Third Party Advisory
https://huntr.dev/bounties/da6d03e6-053f-43b6-99a7-78c2e386e3edExploit, Third Party Advisory
https://github.com/polonel/trudesk/commit/4f48b3bb86ba66a0085803591065bb6437e864ecPatch, Third Party Advisory
https://huntr.dev/bounties/da6d03e6-053f-43b6-99a7-78c2e386e3edExploit, Third Party Advisory

Timeline

Published: Apr 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-12915.4XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting CVE-2022-12927.3The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operati CVE-2022-12936.1The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.CVE-2022-12944.8The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to CVE-2022-12959.8Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.CVE-2022-12969.1Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow att CVE-2022-12979.1Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow CVE-2022-12984.8The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as CVE-2022-12994.8The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-pri CVE-2022-13009.8Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of this function may resul CVE-2022-13014.8The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow CVE-2022-13027.5In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a den