CVE-2022-22146

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
TAGAWA Takao	TransmitMail	2.5.0 to 2.6.1

References

https://dounokouno.com/2022/01/25/about-the-vulnerability-of-transmitmail-v2-5-0-v2-6-1/Vendor Advisory
https://jvn.jp/en/jp/JVN70100915/index.htmlThird Party Advisory
https://dounokouno.com/2022/01/25/about-the-vulnerability-of-transmitmail-v2-5-0-v2-6-1/Vendor Advisory
https://jvn.jp/en/jp/JVN70100915/index.htmlThird Party Advisory

Timeline

Published: Feb 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-221487.8'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENT CVE-2022-221498.8A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted H CVE-2022-22154.8The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege user CVE-2022-221508.8A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted CVE-2022-221518.1CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versi CVE-2022-221526.5A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the sys CVE-2022-221537.5An Insufficient Algorithmic Complexity combined with an Allocation of Resources Without Limits or Throttling vulnerability in the flow proce CVE-2022-221546.8In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Ju CVE-2022-221556.5An Uncontrolled Resource Consumption vulnerability in the handling of IPv6 neighbor state change events in Juniper Networks Junos OS allows CVE-2022-221567.4An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle (PitM) attac CVE-2022-221579.3A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juni CVE-2022-221597.5A vulnerability in the NETISR network queue functionality of Juniper Networks Junos OS kernel allows an attacker to cause a Denial of Servic