CVE-2022-21649

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "<" or ">" but escaping for double quotes does not exist. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-21654.3Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing CVE-2022-216505.4Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload CVE-2022-216516.1Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirect CVE-2022-216528.1Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a CVE-2022-216537.5Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't over CVE-2022-216549.8Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation CVE-2022-216557.5Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal CVE-2022-216565.9Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to impl CVE-2022-216576.5Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set CVE-2022-216586.3Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Se CVE-2022-216595.3Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user CVE-2022-21669.8Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.