CVE-2022-1514

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-15155.5A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially CVE-2022-15165.5A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user t CVE-2022-15179.8LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, whi CVE-2022-15189.8LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.CVE-2022-15199.8LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including CVE-2022-15204.3When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may sho CVE-2022-15219.1LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive CVE-2022-15225.3The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization CVE-2022-15239.1Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to a write-what-where condition, which could allow an attacker to overwrite pr CVE-2022-15245.9LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credenti CVE-2022-15259.1The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Serv CVE-2022-15265.4A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articl