CVE-2022-25038

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

wanEditor v4.7.11 was discovered to contain a cross-site scripting (XSS) vulnerability via the video upload function.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 31, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2022

CVE-2022-25049.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SDD Computer Software SDD-Baro allows CVE-2022-250414.3OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.CVE-2022-250447.8Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.CVE-2022-250459.8Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges CVE-2022-250469.8A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.CVE-2022-250475.9The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.CVE-2022-250488.8Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.CVE-2022-25058.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of meCVE-2022-250505.5rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows attackers to cause aCVE-2022-250515.5An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.CVE-2022-250609.8TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.CVE-2022-250619.8TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.
CVE-2022-25038: Medium severity, CVSS 6.1 | Vulnix