CVE-2022-25979

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	jsuites	< 5.0.1
n/a	org.webjars.npm:jsuites	< *

References

https://github.com/jsuites/jsuites/commit/b31770d5fe91684a00177f629aab933139c32d9fPatch, Third Party Advisory
https://github.com/jsuites/jsuites/issues/134Issue Tracking, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253331Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-JSUITES-3226764Exploit, Third Party Advisory
https://github.com/jsuites/jsuites/commit/b31770d5fe91684a00177f629aab933139c32d9fPatch, Third Party Advisory
https://github.com/jsuites/jsuites/issues/134Issue Tracking, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253331Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-JSUITES-3226764Exploit, Third Party Advisory

Timeline

Published: Jan 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-25985.5Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.CVE-2022-259809.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. T CVE-2022-259864.3Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the CVE-2022-259879.8Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version 2021.6 for Intel(R) CVE-2022-259898.8An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-c CVE-2022-25996.1The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outpu CVE-2022-259905.3On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Note: Software versions whic CVE-2022-259927.8Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentiall CVE-2022-259958.8A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted netw CVE-2022-259969.8A stack-based buffer overflow vulnerability exists in the confsrv addTimeGroup functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A s CVE-2022-259997.8Uncontrolled search path element in the Intel(R) Enpirion(R) Digital Power Configurator GUI software, all versions may allow an authenticate CVE-2022-26005.4The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbi