CVE-2022-25847

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-258487.5This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets f CVE-2022-258496.1The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter th CVE-2022-25857.8It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-af CVE-2022-258507.5The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set CVE-2022-258517.5The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite CVE-2022-258527.5All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast t CVE-2022-258537.8All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitiza CVE-2022-258545.4This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and a CVE-2022-258557.8All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sani CVE-2022-258567.5The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReade CVE-2022-258577.5The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for c CVE-2022-258587.5The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure