CVE-2022-28978

MediumCVSS 5.4/10Last modified Jul 9, 2026

Description

Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-289796.1Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was disco CVE-2022-28985.5Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service CVE-2022-289806.1Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary CVE-2022-289817.5Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access file CVE-2022-289826.1A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attacke CVE-2022-289855.4A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web CVE-2022-289867.5LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerabili CVE-2022-289875.3Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/CVE-2022-289907.8WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm.CVE-2022-289917.5Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to acc CVE-2022-289928.8A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST re CVE-2022-289939.8Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request.