CVE-2022-26596

MediumCVSS 6.1/10Last modified Jul 9, 2026

Description

Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://liferay.dev/w/cve-2022-26596-stored-xss-with-template-name

Timeline

Published: Apr 25, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-265976.1Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DX CVE-2022-26607.5Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow CVE-2022-266058.8eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality.CVE-2022-266077.2A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via upload CVE-2022-26618.8Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions us CVE-2022-266129.8In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a resul CVE-2022-266139.8PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php.CVE-2022-266155.4A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scrip CVE-2022-266166.1PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP he CVE-2022-266197.5Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.CVE-2022-26629.8Sequi PortBloque S has a improper authentication issues which may allow an attacker to bypass the authentication process and gain user-level CVE-2022-266246.1Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/a