CVE-2022-2300

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
microweber	microweber/microweber	>= unspecified, < 1.2.19

References

https://github.com/microweber/microweber/commit/70b46e231e7b2c113666745a0ab6de9a8b7ef08ePatch, Third Party Advisory
https://huntr.dev/bounties/882d6cf9-64f5-4614-a873-a3030473c817Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/microweber/microweber/commit/70b46e231e7b2c113666745a0ab6de9a8b7ef08ePatch, Third Party Advisory
https://huntr.dev/bounties/882d6cf9-64f5-4614-a873-a3030473c817Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jul 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-230007.8The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. T CVE-2022-230015.3When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with CVE-2022-230025.3When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properl CVE-2022-230035.3When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output CVE-2022-230045.3When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is CVE-2022-230058.7Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in CVE-2022-230066.7A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow CVE-2022-230085.4On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undis CVE-2022-230097.2On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access ot CVE-2022-23015.5Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.CVE-2022-230107.5On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when CVE-2022-230117.5On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while pr