CVE-2022-2113

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
inventree	inventree/inventree	>= unspecified, < 0.7.2

References

https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84fPatch, Release Notes, Third Party Advisory
https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57Exploit, Patch, Third Party Advisory
https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84fPatch, Release Notes, Third Party Advisory
https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57Exploit, Patch, Third Party Advisory

Timeline

Published: Jun 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-211315.5Improper access control for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable information disclosure vi CVE-2022-211326.5Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0 CVE-2022-211335.5Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable CVE-2022-211347.5A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A sp CVE-2022-211365.5Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local CVE-2022-211377.8Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allo CVE-2022-211398.8Inadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escal CVE-2022-21144.8The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could CVE-2022-211405.5Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enabl CVE-2022-211419.8MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5 CVE-2022-211429.8Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.CVE-2022-211439.8MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5