CVE-2022-25321

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/cerebrate-project/cerebrate/commit/14ec995c2bd618b181197dc6b64e63fd966b4860Patch, Third Party Advisory
https://github.com/cerebrate-project/cerebrate/commit/e13b4e7bc5f1a0ff59b52162cc99405e89c0544aPatch, Third Party Advisory
https://zigrin.com/advisories/cerebrate-cross-site-scripting-xss-in-bookmarks/Third Party Advisory
https://zigrin.com/cakephp-application-cybersecurity-research-be-careful-with-reflections-for-your-web-application-security/Exploit, Third Party Advisory
https://github.com/cerebrate-project/cerebrate/commit/14ec995c2bd618b181197dc6b64e63fd966b4860Patch, Third Party Advisory
https://github.com/cerebrate-project/cerebrate/commit/e13b4e7bc5f1a0ff59b52162cc99405e89c0544aPatch, Third Party Advisory
https://zigrin.com/advisories/cerebrate-cross-site-scripting-xss-in-bookmarks/Third Party Advisory
https://zigrin.com/cakephp-application-cybersecurity-research-be-careful-with-reflections-for-your-web-application-security/Exploit, Third Party Advisory

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-253229.8ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.CVE-2022-253236.1ZEROF Web Server 2.0 allows /admin.back XSS.CVE-2022-253247.5All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the CVE-2022-253257.8Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause inform CVE-2022-253265.5fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust fi CVE-2022-253275.5The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that preven CVE-2022-253287.3The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a spec CVE-2022-253299.8Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in CVE-2022-25337.4An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2 CVE-2022-253309.8Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the pr CVE-2022-253317.5Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remote attacker to crash CVE-2022-253324.1The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which c