CVE-2022-28448

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code to First name or Last name at Customer Info.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-284496.1nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upload an arbitrary fil CVE-2022-28457.8Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.CVE-2022-284505.4nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a re CVE-2022-284517.5nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.CVE-2022-284529.8Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection.CVE-2022-284546.1Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting (XSS).CVE-2022-28464.3The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event CVE-2022-284619.8mingyuefusu Library Management System all versions as of 03-27-2022 is vulnerable to SQL Injection.CVE-2022-284627.5novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.CVE-2022-284637.8ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.CVE-2022-284649.0Apifox through 2.1.6 is vulnerable to Cross Site Scripting (XSS) which can lead to remote code execution.CVE-2022-284679.8Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID parameter.