CVE-2022-25313

MediumCVSS 6.5/10Last modified Oct 14, 2026

Description

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

No affected versions have been published.

Timeline

Published
Feb 18, 2022
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-253147.5In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.CVE-2022-253159.8In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.CVE-2022-253176.1An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.CVE-2022-253184.3An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groCVE-2022-253195.3An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.CVE-2022-25326.1The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading tCVE-2022-253205.3An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.CVE-2022-253216.1An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.CVE-2022-253229.8ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.CVE-2022-253236.1ZEROF Web Server 2.0 allows /admin.back XSS.CVE-2022-253247.5All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of theCVE-2022-253257.8Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause inform
CVE-2022-25313: Medium severity, CVSS 6.5 | Vulnix