CVE-2022-27166

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache JSPWiki	>= Apache JSPWiki, <= Apache JSPWiki up to 2.11.2

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732Vendor Advisory
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732Vendor Advisory

Timeline

Published: Aug 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-271677.1Privilege escalation vulnerability in Windows products of ESET, spol. s r.o. allows attacker to exploit "Repair" and "Uninstall" features wh CVE-2022-271686.1Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecifie CVE-2022-271697.5An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16 CVE-2022-27174.9The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' par CVE-2022-271707.8Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable CVE-2022-271728.8A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafte CVE-2022-271744.3Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to CVE-2022-271759.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This CVE-2022-271767.8Incomplete filtering of special elements vulnerability exists in RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, CVE-2022-271779.8A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to CVE-2022-271789.8A denial of service vulnerability exists in the confctl_set_wan_cfg functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-cr CVE-2022-271796.5A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protecte