CVE-2022-28449

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upload an arbitrary file to the system.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 26, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-28457.8Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.CVE-2022-284505.4nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a reCVE-2022-284517.5nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.CVE-2022-284529.8Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection.CVE-2022-284546.1Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting (XSS).CVE-2022-28464.3The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an eventCVE-2022-284619.8mingyuefusu Library Management System all versions as of 03-27-2022 is vulnerable to SQL Injection.CVE-2022-284627.5novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.CVE-2022-284637.8ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.CVE-2022-284649.0Apifox through 2.1.6 is vulnerable to Cross Site Scripting (XSS) which can lead to remote code execution.CVE-2022-284679.8Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID parameter.CVE-2022-284689.8Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.