CVE-2022-29296

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/167341/Avantune-Genialcloud-ProJ-10-Cross-Site-Scripting.htmlBroken Link, Third Party Advisory, VDB Entry
https://dl.packetstormsecurity.net/2206-exploits/avantunegenialcloudproj10-xss.txtBroken Link, Third Party Advisory
http://packetstormsecurity.com/files/167341/Avantune-Genialcloud-ProJ-10-Cross-Site-Scripting.htmlBroken Link, Third Party Advisory, VDB Entry
https://dl.packetstormsecurity.net/2206-exploits/avantunegenialcloudproj10-xss.txtBroken Link, Third Party Advisory

Timeline

Published: Jun 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-292987.5SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.CVE-2022-29307.8Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-293025.5SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/Solar_Ftp.php.CVE-2022-293039.8SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.CVE-2022-293048.8Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete_ Facility.CVE-2022-293058.1imgurl v2.31 was discovered to contain a Blind SQL injection vulnerability via /upload/localhost.CVE-2022-293069.8IonizeCMS v1.0.8.1 was discovered to contain a SQL injection vulnerability via the id_page parameter in application/models/article_model.php CVE-2022-293079.8IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy_lang_content in application/models/lang CVE-2022-293097.5mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.CVE-2022-29317.5A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15 CVE-2022-293158.8Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.CVE-2022-293169.8Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advanc